Download to read offline
![Existing Malware Viz Tools
compare system calls
[Trinius et al, 2009]
[Saxe et al, 2012]
individual malware
[Conit et al, 2008]
[Quist and Lierbrock,
2009]
[Domas, 2012]](https://image.slidesharecdn.com/seem-presentationinvincea2-17-15-150218074745-conversion-gate01/75/Webcast-The-Similarity-Evidence-Explorer-For-Malware-6-2048.jpg)
![SEEM Demo
[ DEMO ]
try it yourself: www.cynomix.org](https://image.slidesharecdn.com/seem-presentationinvincea2-17-15-150218074745-conversion-gate01/75/Webcast-The-Similarity-Evidence-Explorer-For-Malware-11-2048.jpg)
Uploaded byInvincea, Inc.
Webcast: The Similarity Evidence Explorer For Malware
The document discusses the Similarity Evidence Explorer for malware, a data visualization tool developed by Robert Gove, aimed at aiding malware analysts in comparing malware attributes efficiently. The tool enables large-scale comparisons through features like histograms and detailed visualizations, facilitating the analysis of numerous malware samples. For further information and access to the tool, users are directed to the Cynomix website.
More Related Content
Similar to Webcast: The Similarity Evidence Explorer For Malware
Webcast: The Similarity Evidence Explorer For Malware
- 1. The Similarity Evidence Explorerfor Malware A SCALABLE VISUALIZATION FOR COMPARING MALWARE ATTRIBUTES Robert Gove Senior Research Engineer, LABS | FAIRFAX, VA 2/18/2015 1
- 2. Meet the Presenter RobertGove is a Senior Research Engineer at Invincea Labs. He is a data visualization expert who has recently worked on Cynomix, a web- based community malware triage tool. He has several years of experience designing and implementing novel visualizations to support analysts in answering complicated questions. Robert has a Master of Science in Computer Science from The University of Maryland where his thesis was on evaluating visualization tools for citation network exploration.
- 3. Malware Analysis UseCase SITUATION: Major corporation hacked • Stack of malware to analyze • Need to compare to other malware
- 4.
- 5. Need to CompareMalware comparison 1 %s Connected! /fetch.py cmd.exe __getmainargs _controlfp add “HKCU” advapi32.dll AllocConsole Analog CloseHandle cmd.exe CreatePipe DeleteFileA FileSize InternetConnect InternetOpen InternetOpenUrl kernel32.dll read failed lstrlenA . . . focal sample %s Connected! /fetch.py cmd.exe __getmainargs _controlfp Accept:*/* add “HKCU” advapi32.dll Analog CloseHandle cmd.exe CreatePipe DeleteFileA FileSize InternetConnect InternetOpen InternetOpenUrl kernel32.dll read failed lstrcatA . . . comparison 2 /install __getmainargs __p__commode _controlfp _strnicmp add “HKCU” advapi32 Analog cd-rom check service CloseServiceHandle cmdpath= CopyPathA DeleteFileA Install service HTTPQueryInfo InternetOpen InternetOpenUrl read failed lstrcatA . . . comparison n /install __getmainargs __p__fmode _initterm _strcmpi Accept:*/* add “HKCU” advapi32 tcp cmdpath= CopyFileA FileSize Install service HTTPQueryInfo InternetOpen InternetOpenUrl read failure lstrcatA msvcrt.dll net start . . . …
- 6. Existing Malware VizTools compare system calls [Trinius et al, 2009] [Saxe et al, 2012] individual malware [Conit et al, 2008] [Quist and Lierbrock, 2009] [Domas, 2012]
- 7.
- 8. Similarity Histogram overview of similaritywith focal sample
- 9.
- 10.
- 11. SEEM Demo [ DEMO] try it yourself: www.cynomix.org
- 12. SEEM Conclusion • Large-scalemalware comparison –Comparison overviews with histograms –Detailed visualizations of comparisons compare large group of malware across sets of strings, DLLs, and function calls Interested? www.cynomix.org cynomix@invincea.comSupported by DARPA award FA8750-10-C-0169 as part of Cyber Genome
- 13. Questions? @Invincea @InvinceaLabs @rpgove Learn more aboutInvincea’s solutions or visit our website at www.invincea.com Contact us at 1-855-511-5967