Slashdot Mirror
Hunting Malware With GPUs and FPGAs (hackaday.com)
szczys writes: Rick Wesson has been working on a solution to identify the same piece of malware that has been altered through polymorphism (a common method of escaping detection). While the bits are scrambled from one example to the next, he has found that using a space filling curve makes it easy to cluster together polymorphically similar malware samples. Forming the fingerprint using these curves is computationally expensive. This is an Internet-scale problem which means he currently needs to inspect 300,000 new samples a day. Switching to a GPU to do the calculation proved four orders of magnitude efficiency over CPUs to reach about 200,000 samples a day. Rick has begun testing FPGA processing, aiming at a goal of processing 10 million samples in four hours using a machine drawing 4000 Watts.
Wow how are you powering this thing a dryer plug?
Multiple PSUs?
That's a heck of a lot of power for a single machine.
Minimum threshold fixed. Thanks!
All the malware authors could make some easy money selling him some processing time from all the botnets they run.
Graphics Processing Unit.
It's more or less a CPU with more cores and less functionality per core. There are typically a few instructions you would otherwise expect form a DSP like saturated addition.
For research, this seems invaluable. I'm sure it will help a lot in profiling real attackers right now.
As an effective deterrent, I cannot imagine this will be viable long-term. It seems to me that it is much easier for the attackers to generate more permutations than it is for the defenders to identify them. Will clients be able to keep up with matching against that many definitions? Maybe you only scan on particular servers, and because of the CPU intensive nature, you sell it as a service. Well, guess what? Everything would have to be decrypted to be identified, so then there are privacy concerns.
In the worst case scenario, your attackers run their malware through FPGAs to send a unique permutation to each victim.
The Daddy casts sleep on the Baby. The Baby resists!
Switching to a GPU to do the calculation proved four orders of magnitude efficiency over CPUs to reach about 200,000 samples a day.
4 orders of magnitude?! Was he processing 20 samples a day before? What kind of CPU was he using? 8088?
Really, 4 orders of magnitude? 10000 times faster with GPUs than CPUs? I call bullshit. You might get a factor of 100 if you pick a SoA GPU and a shitty CPU. But comparing things of similar generation, you will not get a factor of 100 on modern hardware. So either they are not in base 10, or there is BS going on.
I hope he does something useful with the heat. And now we're giving the electric company some incentive to make viruses. If all this detective work generates so much revenue, well, as Kennedy said, "why not?"
“He’s not deformed, he’s just drunk!”
That's an extreme oversimplification.
If you assume you have 1000 threads of execution, you could execute each one independently on a 1000 core machine. This is not true on a GPU. Those threads on a GPU will be grouped together. Each thread in a group will be executing the same instructions, so you can't have each thread executing done independent code.
Conventional CPUs can handle any permutation of branch. In the GPU if you have an "if-else" condition and some threads in a group do the "if" and others do the "else" you have to wait for the if case first then execute the else case.
Eternal September.
"So long and thanks for all the fish."
The only reason Windows has more malware is it is far more used (even on servers it's a 50/50 split out there to this very day vs. Linux). It's a greater return on investment in botnet creation alone on those grounds since a botnet's more effective with greater numbers of enslaved nodes to call on for say, a DDoS attack. You're going to get that using Windows which commands a good 94% of the pc market on pc desktops against Linux or MacOS X. That's the only real reason. Not that Windows is less securable (and windows is easily security hardened against that as are even *NIX variants I noted. None of them are as secured as possible in default configurations by default out of the box)
Finding malware benefits most computer users. Could this search be spread over large numbers of computers across the Internet? Computer owners could volunteer spare machines cycles to aid the search.
WTF is a GPU?
An indication that you stumbled onto the wrong site, read the wrong article, and then proceeded to comment just to figure out where on the internet you ended up.
Here let me direct you back to mainstream media