Applied machine learning defeating modern malicious documents

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Evan Gaustad
Applied Machine Learning:
Defeating Modern Malicious Documents
HT-W02
Sr. Manage...

#RSAC
Agenda
2
Office Macro Use and Abuse
Malicious documents in attack lifecycle
Machine Learning for Malware Detection
D...

#RSAC
Macro-enabled Microsoft Office Documents
3
An office macro is code that
automates tasks in office documents
Automati...

#RSAC
Attacker motivation for malicious office docs
4
Barrier of entry is very low
Uses built in, cross-platform features
...

#RSAC
Malicious Macro-enabled Office Documents
5
Used by an attacker to gain code execution
on the targeted system(s)
Comm...

#RSAC
Example: Maldocs in Attack Lifecycle
1) Phishing email
with attachment
“Invoice Past Due”
6

#RSAC
7
1) Phishing email
with attachment
“Invoice Past Due”
2) Victim opens file,
allows macros to run
Example: Maldocs i...

#RSAC
Example: Maldocs in Attack Lifecycle
8
1) Phishing email
with attachment
“Invoice Past Due”
2) Victim opens file,
al...

#RSAC
Example: Maldocs in Attack Lifecycle
9
1) Phishing email
with attachment
“Invoice Past Due”
2) Victim opens file,
al...

#RSAC
Example: Maldocs in Attack Lifecycle
10
1) Phishing email
with attachment
“Invoice Past Due”
2) Victim opens file,
a...

#RSAC
Example: Maldocs in Attack Lifecycle
11
1) Phishing email
with attachment
“Invoice Past Due”
2) Victim opens file,
a...

#RSAC
Detecting Malicious Macros
How hard is it to create:
a malicious macro…
that runs an executable…
on victim’s machine...

#RSAC
Detecting Malicious Macros
How hard is it to create:
a malicious macro…
that runs an executable…
on victim’s machine...

#RSAC
Detecting Malicious Macros
14

#RSAC
Detecting Malicious Macros
15

#RSAC
Why Machine Learning?
16
Existing anti-virus and sandbox techniques can be subverted
Automates extracting insight fr...

#RSAC
Project Approach
17
Goals:
Triage: Determine whether a new Microsoft Office document contains a
malicious or benign ...

#RSAC
Applied Machine Learning Steps
18
Benign Files
Malicious Files
Collect labeled data

#RSAC
Applied Machine Learning Steps
19
Benign Files
Malicious Files
Feature
Extraction
5.7 10 98 …
1.2 23 15 …
0.7 57 20 ...

#RSAC
“Feature Engineering”
20
DOCUMENT #1
…
BHJASD = Chr(102 + 8)
Set uHhdBhd = CreateObject("" & "W"
& "" & "or" & "d." ...

#RSAC
“Feature Engineering”
21
DOCUMENT #1
…
BHJASD = Chr(102 + 8)
Set uHhdBhd = CreateObject("" & "W"
& "" & "or" & "d." ...

#RSAC
Feature Engineering
22

#RSAC
Feature Engineering
23

#RSAC
Applied Machine Learning Steps
24
Benign Files
Malicious Files
Feature
Extraction
5.7 10 98 …
1.2 23 15 …
0.7 57 20 ...

#RSAC
Choose and Test Model
25
DOCUMENT #1
…
BHJASD = Chr(102 + 8)
Set uHhdBhd = CreateObject("" & "W"
& "" & "or" & "d." ...

#RSAC
Simple Decision Tree Model
26
entropy <= 4.27
samples = 88
samples = 47
class = benign
# comments <= 39.0
samples = ...

#RSAC
Simple Decision Tree Model
27
entropy <= 4.27
samples = 88
samples = 47
class = benign
# comments <= 39.0
samples = ...

#RSAC
Applied Machine Learning Steps
28
Benign Files
Malicious Files
Feature
Extraction
5.7 10 98 …
1.2 23 15 …
0.7 57 20 ...

#RSAC
Malicious Macro Bot Project
29
Model factored in over 20,000 samples
Analyzed over 121,000 samples from 7 months of ...

#RSAC
Demo: Malicious Macro Bot Project
30
Demonstrate classification
Gaining insight from machine learning features
Ident...

#RSAC
Conclusion
31
Project Uses:
Threat Intelligence: Identify new phishing campaigns
Detection: Fill traditional detecti...

#RSAC
Thank You!
32
https://github.com/egaus/MaliciousMacroBot

#RSAC
References
33
[1] Proofpoint “Human Factor Report”, 2016. https://www.proofpoint.com/sites/default/files/human-facto...

#RSAC
Thank You!
34
Questions?

#RSAC
Offline Demo
35

#RSAC
Identifying Phishing Campaigns
36

#RSAC
Identifying Phishing Campaigns
37

#RSAC
Identifying Phishing Campaigns
38

#RSAC
Identifying Phishing Campaigns
39

#RSAC
Identifying Phishing Campaigns
40

#RSAC
Identifying Phishing Campaigns
41

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 41 Ad

View on Slideshare

1 of 41 Ad