))
Malfaces: Automating Malware Triage
Manage episode 310835938 series 3074403
Content provided by Carnegie Mellon University Software Engineering Institute and Members of Technical Staff at the Software Engineering Institute. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Carnegie Mellon University Software Engineering Institute and Members of Technical Staff at the Software Engineering Institute or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://ppacc.player.fm/legal.
Malfaces from the Software Engineering Institute is a two-tool process that visualizes similarities between malware input files. The first tool uses binary code comparison techniques and a transform function to determine which input files match. Then, using statistical analysis, the second tool draws Chernoff faces for each file and delivers an estimate of how many unique programs are in the input files set. Together, these tools reduce file analysis to a differential analysis task—saving time and money in reverse engineering after a cyber incident. You can find more on the Malfaces concept in “This Malware Looks Familiar: Laymen Identify Malware Run-time Similarity with Chernoff faces and Stick Figures” at http://eudl.eu/doi/10.4108/eai.22-3-2017.152417
102 episodes
Share
