Slashdot Mirror
Hunting Malware With GPUs and FPGAs (hackaday.com)
szczys writes: Rick Wesson has been working on a solution to identify the same piece of malware that has been altered through polymorphism (a common method of escaping detection). While the bits are scrambled from one example to the next, he has found that using a space filling curve makes it easy to cluster together polymorphically similar malware samples. Forming the fingerprint using these curves is computationally expensive. This is an Internet-scale problem which means he currently needs to inspect 300,000 new samples a day. Switching to a GPU to do the calculation proved four orders of magnitude efficiency over CPUs to reach about 200,000 samples a day. Rick has begun testing FPGA processing, aiming at a goal of processing 10 million samples in four hours using a machine drawing 4000 Watts.
WTF is a GPU?
Wow how are you powering this thing a dryer plug?
Multiple PSUs?
That's a heck of a lot of power for a single machine.
Minimum threshold fixed. Thanks!
All the malware authors could make some easy money selling him some processing time from all the botnets they run.
Awful lot of links to hackaday lately, including that stupid one that basically said "good tools are better than bad ones".
For research, this seems invaluable. I'm sure it will help a lot in profiling real attackers right now.
As an effective deterrent, I cannot imagine this will be viable long-term. It seems to me that it is much easier for the attackers to generate more permutations than it is for the defenders to identify them. Will clients be able to keep up with matching against that many definitions? Maybe you only scan on particular servers, and because of the CPU intensive nature, you sell it as a service. Well, guess what? Everything would have to be decrypted to be identified, so then there are privacy concerns.
In the worst case scenario, your attackers run their malware through FPGAs to send a unique permutation to each victim.
The Daddy casts sleep on the Baby. The Baby resists!
Switching to a GPU to do the calculation proved four orders of magnitude efficiency over CPUs to reach about 200,000 samples a day.
4 orders of magnitude?! Was he processing 20 samples a day before? What kind of CPU was he using? 8088?
Really, 4 orders of magnitude? 10000 times faster with GPUs than CPUs? I call bullshit. You might get a factor of 100 if you pick a SoA GPU and a shitty CPU. But comparing things of similar generation, you will not get a factor of 100 on modern hardware. So either they are not in base 10, or there is BS going on.
I hope he does something useful with the heat. And now we're giving the electric company some incentive to make viruses. If all this detective work generates so much revenue, well, as Kennedy said, "why not?"
“He’s not deformed, he’s just drunk!”
Use systems that aren't vulnerable instead. (I.e. anything not from microsoft). Malware is not much of a problem, except on windows. And there are quite a few alternatives to windows these days.
Finding malware benefits most computer users. Could this search be spread over large numbers of computers across the Internet? Computer owners could volunteer spare machines cycles to aid the search.
When I first read this in my head it was:
"Hunting Malware In GPUs and FPGAs"
I was imagining a team of engineers scouring datasheets and reverse engineering register interfaces and blocks of logic.
Reality is so much more... rudimentary.