Slashdot Mirror
Researchers Use Machines To Analyze Malware
Krishna Dagli writes to mention a Register article about a mechanical process for analyzing malware. Using an automated system, researchers are able to more accurately classify the often randomly-named bots and viruses that plague us. From the article: "The researchers modeled a piece of malicious software as the series of actions that the software takes at the operating system level. Referred to as 'events' in a paper written by Lee and anti-malware program team manager Jigar Mody, the actions can include data copying, changing registry keys and opening network connections. The researchers then trained a recognition engine using an adaptive clustering algorithm - similar to self-organising maps - and classified a previously unseen subset of malware using the trained system. Using more clusters typically resulted in better classification. When the software samples were classified based on 100 events, accuracy fell below 80 per cent, while classification based on 500 and 1,000 events typically has accuracy rates above 90 per cent."
Obviously solutions like this will be the way of the future, combined with a finer grained permission system. I just hope you can manually exempt programs. For example bittorrent opens a lot of network connections, and copies a lot of data around; I could see a tool such as this reasonably coming to the conclusion that it was malware. I am also curious if their system could defeat a rootkit, which will do its best to hide its activity and existence almost completely from the system.
Philosophy.
Does this new classification method really have any advantages for the average user? I'm sure most people just want to keep their systems malware-free, and could care less about the names of the individual threats.
What? Really? Of course, I didn't read the summary yet.
Now instead of obscure names like W32/worm.169/06A they can give them meaningful names like W32/fucks.your.harddrive.and.emails.itself.to.all. your.friends.169/06A.
So, basically, we'll have another anti-virus-like program monitoring our systems.
Yay for the multi-core CPUs!
Ignore this signature. By order.
I think the program is bugged, it keeps telling me that something called Windows is malware.
Researchers Use Machines To Analyze Malware
as opposed to punch cards?
Attempts at classifying malware automatically have been around for a number of years. Trouble is: 90% isn't good enough--it's too many false alarms. You need something that works almost perfectly in order to deploy it on real machines.
http://www.linux.org/
Maybe it could be trained to categorize my socks?
and classified a previously unseen subset of malware using the trained system
automated systems determined that the new worm, W32.setup/install.exe is the most prevalent ever, due to the success of its social-engineering attack vector.
Rule 1: O/S weight={linux:1, windows:99}
Rule 2: Contains Sony copyright={no:0, Yes:90}
Rule 3: Changes Registry={no:0, yes:99}
"...bots and viruses that plague us" What's this "us" shit Kemosabe? I've never experienced any bots and/or viruses in the past 5 years or more. What kinda system are you running that has this affliction?
If I didn't have absolutely NOTHING to do, I wouldn't be here.
this really struck my eyes:
"80 per cent, while classification based on 500 and 1,000 events typically has accuracy rates above 90 per cent."
shouldn't it be percent ?
After reading 12 of the 17 page MS document I shake my head... Some malware do not run properly in VM. Some packers are known to detect VM environment and prevent the file from normal execution. What about smarter polymorphs which change and adapt not to mention their analysis', tests, etc., did not include a full scope of what malware targets: "Runtime environment simulation is still primitive. For example, we have not implemented Instant Messaging or P2P applications/servers." Couple this with: "The biggest benefit is more rapid response to complex threats. As the synergy between viruses, Trojans, worms, rootkits and exploits grows, waiting for a solution becomes more dangerous." And lest I forget "This two-part article series looks at how cryptography is a double-edged sword: it is used to make us safer, but it is also being used for malicious purposes within sophisticated viruses. Part two continues the discussion of armored viruses and then looks at a Bradley worm - a worm that uses cryptography in such a way that it cannot be analyzed. (source). So what happens when malware writers get a clue and start creating their own forms of crypto to hide their actions. For any company to create a product whether its hardware or software based, they'd only be lying to a degree about their ability to detect complex threats no matter what engine their malware snoopers were using.
Infiltrated dot Net
Cent is short for century, or centi, if you are of that orientation. 80 per 100 is correct. Percent is WRONG! as is your "5 cent" which should be 5 cents, or nickel if you are of that persuation. This is the way it is to-day. To-morrow things may, can, and will change. Return to your reader.
If you think about it, this is more to do with how folks that are paid to give us those fancy virus definition libraries than the average user, but end benefit is that all users at all levels will be able to handle these malware threats more specifically than just using random deletion methods. For example, I was an idiot got a keylogger onto my system [which isn't hard to do since it's a Bloze box...], but I haven't noticed any of my accounts being accessed as of yet, which of course I did change the passwords after I went back a version [I keep a clean copy of my system as a ghost CD...] on my system just in case. Either way, I notice that most anti-spyware/malware systems could not detect the keylogger, but my virus scanner could and it could not remove it. So, if these classification methods also lead to new methods of eliminating these threats, press on forward. ^_^
-- Bridget
Internet Security Systems already provides a product that does this called "Proventia Desktop". Whenever the user tries to run a program, it first boots a virtual machine, runs the program, looks at all these behaviors (opening connections, setting itself as the Run entry in the registry, etc.). When the right combination of behaviors are detected, it marks it as malware and refuses to run it in the real machine. The entire process takes as much time as it would for anti-virus to scan it. It's about 99% effective, which means that it catches almost all 0-day viruses, but it will occasionally let something through (which is why you should probably also have traditional anti-virus as well).
At the end of the article the Offensive Computing project is mentioned. The url is http://www.offensivecomputing.net. That site isn't trying to sell you anything, its more of a resource for forensic / incident response people to get infomation about malware they run across. Its not a tool you would run on your home computer either, more of a database of malware with some automated basic analysis and fingerprinting.
Computer security is not easy for businesses and more difficult for the average home user .... But it seems to me that as the price of hardware drops and home networks become more plentiful, we will see more 'appliances' that come described as routers/firewalls/proxies that run the appropriate software so that such programs can be detected by signiature before they get to your desktop. Though that would or might be another level of possible infection to home networks, it is still much stronger than a desktop system alone.
One of the things that I've not seen enough of yet is simply booting from CD into DSL or Puppy, and running ClamAV or other programs to route out any malware, virus, or other malicious software on your desktop.
I think that good security is not any single program or approach, but a combination of counter attacks. I think that this is a possible new approach to staying in the antivirus business despite MS attempt to get into that market space.
Read that as a home network with two desktops, served by a firewall/proxy running linux and appropriate software to screen data from websites, email, IM, etc. and tools that do not depend on the OS they are protecting to do the cleaning.
Support NYCountryLawyer RIAA vs People
Back in the days when Macs had viruses (yes they do exist or existed), I was using a program called Gatekeeper. Instead of knowing about certain virus it monitored system activity and alerted you when virus type activity was happening. You the user would either deny or grant the action.
So given my experience with GateKeeper, the ideas of this malware detection seem obvious. Why did it take this long to apply these ideas to windows malware? Is the problem commerical anti-virus software? They prefer you to keep paying for updates, instead to shut down potential malware until they software knows about it?
Brought to you by Team SPAM! where we believe: "Information in the noise!"
>a mechanical process for analyzing malware.
Do you mean it is steam or internal combustion powered? Based on a huge Babbage differential engine, programmed with cards in Lady Ada language? It must be since it is mechanical! The MODUS, a stack of most advanced cards for automated malware analysis is the subject of an international conspiracy. And the London smog gets denser every day.
>a worm that uses cryptography in such a way that it cannot be analyzed
That means nothing. To execute it has to decode itself. AV companies use machines with "Windows checked/debug build" installed that replicates every single instruction over RS232 or USB to another identical machine, so you can see the tiniest detail as you wish. Many AV companies also own factory-rigwired confidental samples of Intel CPUs, which dump instruction execution in plain view, much like a lie detector for CPU or the bit-switch engineering consoles on 1960's era mainframes.
Of course lesser funded, non-commerical, NDA-handicapped entities like ClamAV do not possess these resources, so they may be in trouble.
Do not believe all hype you read in newspapers. Everything written by a human can be cracked by a human, plus AV researchers are better educated than hackers and VXers.