Automatic Analysis of Malware Behavior using Machine Learning - PowerPoint PPT Presentation

Oct 13, 2022 •200 likes •451 views

Automatic Analysis of Malware Behavior using Machine Learning Konrad Rieck, Philipp Trinius, Carsten Willems, Thorsten Holz Peng Su CISC850 Cyber Analytics CISC850 Cyber Analytics Automatic Analysis of Malware Behavior Malware threaten

Automatic Analysis of Malware Behavior using Machine Learning Konrad Rieck, Philipp Trinius, Carsten Willems, Thorsten Holz Peng Su CISC850 Cyber Analytics
CISC850 Cyber Analytics Automatic Analysis of Malware Behavior • Malware threaten the Internet • Dynamic VS Static • binary packers, encryption, or self-modifying code, to obstruct analysis. • behavior of malicious software during run-time.
CISC850 Cyber Analytics Automatic Analysis of Malware Behavior
CISC850 Cyber Analytics Monitoring of Malware Behavior • Malware Sandboxes --CWSandbox • Malware Instruction Set
CISC850 Cyber Analytics Malware Instruction Set • MIST instruction keep the stable and discriminative patterns such as directory and mutex name at the beginning.
CISC850 Cyber Analytics Embedding of Malware Behavior • Embedding using Instruction Q-grams • Comparing Embedding reports
CISC850 Cyber Analytics Embedding using Instruction Q-grams • For example, if report x=‘1|A 2|A 1|A 2|A’, A={1|A, 2|A }, the q for q-grams is 2.
CISC850 Cyber Analytics Embedding using Instruction Q-grams • Normalization • Redundancy of behavior, considered alphabet, length of reports
CISC850 Cyber Analytics Comparing Embedding reports • Euclidean distance
CISC850 Cyber Analytics Clustering and Classification • Prototypes->Clustering-> Classification
CISC850 Cyber Analytics Prototype Extraction
CISC850 Cyber Analytics Clustering using Prototypes
CISC850 Cyber Analytics Classification using Prototypes
CISC850 Cyber Analytics Incremental Analysis
CISC850 Cyber Analytics Experiments & Application • Evaluation Data • Three parameters to decide • Evaluation of Components • How to select the best parameters d p , d c , d r
CISC850 Cyber Analytics Evaluation Data • A reference data set • Evaluate and calibrate the framework • An application data set • See the performance on unknown malwares
CISC850 Cyber Analytics Reference Data Set
CISC850 Cyber Analytics Application Data Set
CISC850 Cyber Analytics Evaluation of Components • Precision and recall
Evaluation of Components • F-measure
CISC850 Cyber Analytics Evaluation of Components--d p
CISC850 Cyber Analytics Evaluation of Components--d c
CISC850 Cyber Analytics Evaluation of Components--d r
CISC850 Cyber Analytics Comparative Evaluation with State-of- the-Art
CISC850 Cyber Analytics An Application Scenario

Download Presentation

Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Machine Learning for Malware Analysis Mike Slawinski Data Scientist Introduction - What is

Machine Learning for Malware Analysis Mike Slawinski Data Scientist Introduction - What is Malware? - Software intended to cause harm or inflict damage on computer systems - Many different kinds: - Adware/Spyware - Backdoors - Viruses

383 views • 26 slides

Machine Learning for Malware Analysis Andrew Davis Data Scientist Introduction - What is

Machine Learning for Malware Analysis Andrew Davis Data Scientist Introduction - What is Malware? - Software intended to cause harm or inflict damage on computer systems - Many different kinds: - Viruses - Adware/Spyware - Backdoors -

904 views • 30 slides

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides

Machine Detectable Network Behavioural Commonalities for Exploits & Malware University of

Machine Detectable Network Behavioural Commonalities for Exploits & Malware University of Amsterdam Alexandros Stavroulakis MSc System & Network Engineering Research Project II What is this about? Automatic generation of malicious

248 views • 22 slides

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides

Malware Analysis Machine Learning Approach Chiheb Chebbi TEK-UP University DeepSec 14-17 Nov

Malware Analysis Machine Learning Approach Chiheb Chebbi TEK-UP University DeepSec 14-17 Nov 2017 Vienna, Austria <whoami/> Computer science engineering student @TEK-UP Cyber security leadership program fellow @Kaspersky_Lab

626 views • 58 slides

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides

When Malware is Packin Heat; Limits of Machine Learning Classifiers Based on Static Analysis

When Malware is Packin Heat; Limits of Machine Learning Classifiers Based on Static Analysis Features Hojjat Aghakhani , Fabio Gri*, Francesco Mecca, Mar0na Lindorfer, Stefano Ortolani, Davide Balzaro*, Giovanni Vigna, Christopher Kruegel

1.01k views • 53 slides

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides

Obfuscated Financial Fraud Android Malware : Detection and Behavior Tracking In Seung, Yang

Obfuscated Financial Fraud Android Malware : Detection and Behavior Tracking In Seung, Yang (KrCERT/CC, KISA) DeepSEC IDSC 2016 Friday, 11 November 2016 Analysis Team at KrCERT/CC, KISA Mobile malware analyst In Seung, Yang Who am I

1.59k views • 72 slides

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal and Wenke Lee College of Computing Georgia Institute of Technology Agenda l Background l Defeating Automated Malware Analysis Host

1.28k views • 28 slides

CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu February 22, 2018 Exploring the Online Ecosystem One nice aspect of malware analysis is that, since much of it originates online and

119 views • 10 slides

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides

A Hands-On Introduction to Automatic Machine Learning Lars Kotthofg University of Wyoming

A Hands-On Introduction to Automatic Machine Learning Lars Kotthofg University of Wyoming larsko@uwyo.edu AutoML Workshop, 28 August 2018, Nanjing 1 Machine Learning Data Machine Learning Predictions 2 Automatic Machine Learning

744 views • 33 slides

Behavior Disorders are Learned Assumptions: People learn to engage in problem behaviors

Raymond G. Miltenberger USF ABA Master s Program Trial-based Functional Analysis Sarah E. Bloom, PhD, BCBA-D Behavior Disorders are Learned Assumptions: People learn to engage in problem behaviors when they experience the

358 views • 16 slides

ABCs of Challenging Behavior Management Cathy Judkins, M.Ed., BCBA, LBA Mission & Values

ABCs of Challenging Behavior Management Cathy Judkins, M.Ed., BCBA, LBA Mission & Values Changing Lives. One Child at a time. One professional at a time. Presenter Info, Background, Experience Began working in the field of autism and

546 views • 35 slides

Functional Behavior Assessment: The beginning of a Function-Based Behavioral Approach to

Functional Behavior Assessment: The beginning of a Function-Based Behavioral Approach to Eliminating Restraint and Seclusion Objectives 1. Understand what FUNCTION means 2. Understand the purpose of an FBA and What it is 3. Understand General

466 views • 45 slides

Reinforcement in Shaping Speech David C. Palmer Smith College National Autism Conference Penn

The Role of Automatic Reinforcement in Shaping Speech David C. Palmer Smith College National Autism Conference Penn State 2018 1 Overview Language acquisition; nature of the problem: Neither genes nor environment seems to be adequate

1.12k views • 82 slides

TESTING FRAMEWORKS Gayatri Ghanakota OUTLINE Introduction to Software Test Automation.

TESTING FRAMEWORKS Gayatri Ghanakota OUTLINE Introduction to Software Test Automation. What is Test Automation. Where does Test Automation fit in the software life cycle. Why do we need test automation. Test Automation using

685 views • 37 slides

Automatic Scenario Generation for Testing and Training Self-driving Cars Adrien Treuille Zoox /

Automatic Scenario Generation for Testing and Training Self-driving Cars Adrien Treuille Zoox / Carnegie Mellon Take 1: Scenario Description Format Design Constraints Drive all simulation modules. Confidential 17 Design Constraints

531 views • 39 slides

Partnering with Joint and Operations Analysis Division 1 UNCLASSIFIED Joint and Operations

UNCLASSIFIED Partnering with Joint and Operations Analysis Division 1 UNCLASSIFIED Joint and Operations Analysis Division undertakes rigorous scientifically-based analysis of Defence operations and capability 2 UNCLASSIFIED Major

457 views • 29 slides

Physician involvement in support of ECI Requested Perspective from the Pediatrician Member of the

Physician involvement in support of ECI Requested Perspective from the Pediatrician Member of the Advisory Committee The Texas Part C ICC ECI Advisory Committee April, 4, 2018 Commonality of Core Components IDEA Part C AAP Medical Home

333 views • 29 slides