As organizations become ever more dependent on networked operations, they are increasingly vulnerable to attack by a variety of attackers, including criminals terrorists and nation states using cyber attacks. New malware attacks, including viruses, Trojans, and
worms, are constantly and rapidly emerging threats However, attackers often reuse code and techniques from previous attacks. Both by recognizing the reused elements from previous attacks and by detecting patterns in the types of modification and reuse observed, we can more rapidly develop defenses, make hypotheses about the source of the malware, and predict and prepare to defend against future attacks We achieve these objectives in Malware Analysis and Attribution using Genetic Information (MAAGI) by
adapting and extending concepts from biology and linguistics. First, analyzing the “genetics” of malware (i.e., reverse engineered representations of the origina program) provides critical information about the program that is not available by looking only at the executable program. Second, the evolutionary process of malware (i.e., the transformation from one species of malware to another) can provide insights into the ancestry of malware, characteristics of the attacker and where future attacks might come from and wha they might look like. Third, functional linguistics is the study of the intent behind communicative acts; its application to malware characterization can suppor the study of the intent behind malware behaviors. To this point in the program, we developed a system tha uses a range of reverse engineering techniques including static, dynamic, behavioral, and functiona analysis that clusters malware into families. We are also able to determine the malware lineage in some situations. Using behavioral and functional analysis we are also able to identify a number of functions and purposes of malware.
Download- ۹۲/۰۴/۱۸