• Home

  • Software

  • Webcast: The Similarity Evidence Explorer For Malware
13
The Similarity Evidence Explorer for Malware A SCALABLE VISUALIZATION FOR COMPARING MALWARE ATTRIBUTES Robert Gove Senior Research Engineer, LABS | FAIRFAX, VA 03/24/2022 1

Webcast: The Similarity Evidence Explorer For Malware

Tags:

Embed Size (px)

Citation preview

Page 1: Webcast: The Similarity Evidence Explorer For Malware

04/15/2023 1

The Similarity Evidence Explorer for Malware

A SCALABLE VISUALIZATION FOR COMPARING MALWARE

ATTRIBUTESRobert Gove

Senior Research Engineer, LABS | FAIRFAX, VA

Page 2: Webcast: The Similarity Evidence Explorer For Malware

Meet the Presenter

Robert Gove is a Senior Research Engineer at Invincea Labs. He is a data visualization expert who has recently worked on Cynomix, a web-based community malware triage tool. He has several years of experience designing and implementing novel visualizations to support analysts in answering complicated questions. Robert has a Master of Science in Computer Science from The University of Maryland where his thesis was on evaluating visualization tools for citation network exploration.

Page 3: Webcast: The Similarity Evidence Explorer For Malware

Malware Analysis Use Case

SITUATION:Major corporation hacked• Stack of malware to

analyze• Need to compare to other

malware

Page 4: Webcast: The Similarity Evidence Explorer For Malware

Scale Is Overwhelming

Page 5: Webcast: The Similarity Evidence Explorer For Malware

Need to Compare Malware

comparison 1%s Connected!/fetch.py\cmd.exe__getmainargs_controlfpadd “HKCU”advapi32.dllAllocConsoleAnalogCloseHandlecmd.exeCreatePipeDeleteFileAFileSizeInternetConnectInternetOpenInternetOpenUrlkernel32.dllread failedlstrlenA...

focal sample%s Connected!/fetch.py\cmd.exe__getmainargs_controlfpAccept:*/*add “HKCU”advapi32.dllAnalogCloseHandlecmd.exeCreatePipeDeleteFileAFileSizeInternetConnectInternetOpenInternetOpenUrlkernel32.dllread failedlstrcatA...

comparison 2/install__getmainargs__p__commode_controlfp_strnicmpadd “HKCU”advapi32Analogcd-romcheck serviceCloseServiceHandlecmdpath=CopyPathADeleteFileAInstall serviceHTTPQueryInfoInternetOpenInternetOpenUrlread failedlstrcatA...

comparison n/install__getmainargs__p__fmode_initterm_strcmpiAccept:*/*add “HKCU”advapi32tcpcmdpath=CopyFileAFileSizeInstall serviceHTTPQueryInfoInternetOpenInternetOpenUrlread failurelstrcatAmsvcrt.dllnet start...

…

Page 6: Webcast: The Similarity Evidence Explorer For Malware

Existing Malware Viz Tools

compare system calls[Trinius et al, 2009][Saxe et al, 2012]

individual malware[Conit et al, 2008][Quist and Lierbrock, 2009][Domas, 2012]

Page 7: Webcast: The Similarity Evidence Explorer For Malware

Similarity Evidence Explorer for Malware

Page 8: Webcast: The Similarity Evidence Explorer For Malware

Similarity Histogram

overview of similarity with focal sample

Page 9: Webcast: The Similarity Evidence Explorer For Malware

Venn Diagram List

Page 10: Webcast: The Similarity Evidence Explorer For Malware

Relationship Matrix

Page 11: Webcast: The Similarity Evidence Explorer For Malware

SEEM Demo

[ DEMO ]

try it yourself: www.cynomix.org

Page 12: Webcast: The Similarity Evidence Explorer For Malware

SEEM Conclusion

• Large-scale malware comparison–Comparison overviews with histograms–Detailed visualizations of comparisons

compare large group of malware across sets of strings, DLLs, and function

calls

Interested? www.cynomix.org

[email protected] by DARPA awardFA8750-10-C-0169 as part of Cyber Genome

Page 13: Webcast: The Similarity Evidence Explorer For Malware

Questions?

@Invincea@InvinceaLabs

@rpgove

Learn more about Invincea’s solutions or visit our website at www.invincea.comContact us at 1-855-511-5967

http://www.invincea.com/

Exploiting Similarity Between Variants to Defeat Malware · Impact of Variation on Malware Defense Adds layer of complication defense was bad enough before variant flood now malware

Exploiting Similarity Between Variants to Defeat Malware · Impact of Variation on Malware Defense Adds layer of complication defense was bad enough before variant flood now malware

Documents
Clustering IoT Malware Samples based on Binary Similarity · 2020. 2. 25. · Similarity digests attempt to solve the nearest neighbor problem using a digest that is superficially

Clustering IoT Malware Samples based on Binary Similarity · 2020. 2. 25. · Similarity digests attempt to solve the nearest neighbor problem using a digest that is superficially

Documents
LAZARUS UNDER THE HOOD - Threatpost · Sony Pictures Entertainment hack and a strong similarity in the malware tools. Sometime later, ... The only case where malware targeting the

LAZARUS UNDER THE HOOD - Threatpost · Sony Pictures Entertainment hack and a strong similarity in the malware tools. Sometime later, ... The only case where malware targeting the

Documents
Exploring Timeline-Based Malware Classification - Springer · Exploring Timeline-Based Malware Classification 3 They claim that the similarity between two files can be determined

Exploring Timeline-Based Malware Classification - Springer · Exploring Timeline-Based Malware Classification 3 They claim that the similarity between two files can be determined

Documents
A FRAMEWORK FOR AUTOMATED SIMILARITY ANALYSIS OF MALWARE · A FRAMEWORK FOR AUTOMATED SIMILARITY ANALYSIS OF MALWARE ... 20 Dr. Amir Asif, ... we investigate the problem of automated

A FRAMEWORK FOR AUTOMATED SIMILARITY ANALYSIS OF MALWARE · A FRAMEWORK FOR AUTOMATED SIMILARITY ANALYSIS OF MALWARE ... 20 Dr. Amir Asif, ... we investigate the problem of automated

Documents
Android Malware Exposed-Evolution of Android Malware

Android Malware Exposed-Evolution of Android Malware

Documents
Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Documents
String Similarity Join With Different Similarity Thresholds ...ynsilva/publications/StringSimilarityJoin.pdf · String Similarity Join With Different Similarity Thresholds Based

String Similarity Join With Different Similarity Thresholds ...ynsilva/publications/StringSimilarityJoin.pdf · String Similarity Join With Different Similarity Thresholds Based

Documents
Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Documents
Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Technology
Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
(2013) similarity metric method of obfuscated malware using function call graph

(2013) similarity metric method of obfuscated malware using function call graph

Technology
A similarity metric method of obfuscated malware using ... · With the popularization of computer and Internet, the number of malwares increases dramati-cally. According to the Message

A similarity metric method of obfuscated malware using ... · With the popularization of computer and Internet, the number of malwares increases dramati-cally. According to the Message

Documents
Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Documents
MR201407 An example of antivirus detection rates and similarity of undetected malware

MR201407 An example of antivirus detection rates and similarity of undetected malware

Technology
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
Replay: Webcast available at: Webcast disponible en

Replay: Webcast available at: Webcast disponible en

Documents
Android Malware Clustering through Malicious Payload Mining · Clustering has been well studied for desktop malware analysis as an e ective triage method. Conventional similarity-based

Android Malware Clustering through Malicious Payload Mining · Clustering has been well studied for desktop malware analysis as an e ective triage method. Conventional similarity-based

Documents
Exploiting Similarity Between Variants to Defeat Malware€¦ · 04/01/2007 | Blackhat DC | Walenstein Exploiting Similarity Between Variants 5 So Few Families, So Many Variants Clearly

Exploiting Similarity Between Variants to Defeat Malware€¦ · 04/01/2007 | Blackhat DC | Walenstein Exploiting Similarity Between Variants 5 So Few Families, So Many Variants Clearly

Documents
Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Documents
† LIVE WEBCAST AUCTION - Platinum Assetsplatinumassets.com/files/auctions/kansasbrochure.pdfLIVE WEBCAST AUCTION † LIVE WEBCAST AUCTION † LIVE WEBCAST AUCTION HUSKY, PET PREFORM

† LIVE WEBCAST AUCTION - Platinum Assetsplatinumassets.com/files/auctions/kansasbrochure.pdfLIVE WEBCAST AUCTION † LIVE WEBCAST AUCTION † LIVE WEBCAST AUCTION HUSKY, PET PREFORM

Documents
Hedge Funds Webcast Series - Thomson Reutersshare.thomsonreuters.com/events/hedge-funds-webcast/webcast1.pdf · Hedge Funds Webcast Series Webcast 1: Systematic News Trading: incorporate

Hedge Funds Webcast Series - Thomson Reutersshare.thomsonreuters.com/events/hedge-funds-webcast/webcast1.pdf · Hedge Funds Webcast Series Webcast 1: Systematic News Trading: incorporate

Documents
Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Documents
MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Documents
An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Documents
Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Education
Simseer.com - Malware Similarity and Clustering Made Easy

Simseer.com - Malware Similarity and Clustering Made Easy

Documents
Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Documents
Symbolic Melodic Similarity (through Shape Similarity)

Symbolic Melodic Similarity (through Shape Similarity)

Technology
Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Documents