https://scholar.dsu.edu/research-symposium/1015/thumbnail.jp

Brizendine, Bramwell

Chona, Ezra

Flack, Micah

Kramer, Nathan

Snyder, Zayn

Steckelberg, Matthew

English

Beadle Scholar at Dakota State University

Dakota State UniversityBeadle ScholarAnnual Research Symposium University PublicationsSpring 3-27-2019Bust-A-Binary: Active Attribution and Analysis ofMalware CampaignsMicah FlackDakota State UniversityNathan KramerDakota State UniversityZayn SnyderDakota State UniversityEzra ChonaDakota State UniversityMatthew SteckelbergDakota State UniversitySee next page for additional authorsFollow this and additional works at: https://scholar.dsu.edu/research-symposiumThis Book is brought to you for free and open access by the University Publications at Beadle Scholar. It has been accepted for inclusion in AnnualResearch Symposium by an authorized administrator of Beadle Scholar. For more information, please contact repository@dsu.edu.Recommended CitationFlack, Micah; Kramer, Nathan; Snyder, Zayn; Chona, Ezra; Steckelberg, Matthew; and Brizendine, Bramwell, "Bust-A-Binary: ActiveAttribution and Analysis of Malware Campaigns" (2019). Annual Research Symposium. 25.https://scholar.dsu.edu/research-symposium/25AuthorsMicah Flack, Nathan Kramer, Zayn Snyder, Ezra Chona, Matthew Steckelberg, and Bramwell BrizendineThis book is available at Beadle Scholar: https://scholar.dsu.edu/research-symposium/25Abstract February 24, 2011 MICAH F LACK ,  NATHAN KRAMER ,  ZAYN SNYDER ,  EZRA  CHONA,  MATTHEW STECKELBERG  ADV ISOR :  BRAMWELL  BR IZEND INE  Bust-A-Binary: Active Attribution and Analysis of Malware Campaigns Methodology Results and Conclusion Background Malware is typically studied in two ways: the first is static analysis, which requires manually abstracting information from several key in-dicators without running the binary and potentially compromising the system; the second is dynamic analysis, which requires running the potential malware and observing how it behaves or reacts to the envi-ronment and user interaction, notwithstanding the files located on the system or network which were spawned by the malware. The research here proposes a novel application of several areas of study. Bust-A-Binary encompasses machine learning, the application of an algo-rithm; this is capable of finding the properties of previously unseen samples between massive sets of data. Machine learning has a broad variety of approaches that it takes to a solution, rather than a single method. These approaches have different capacities and different tasks that they suit best. Utilizing different approaches, this research aims to provide a tool that can effectively combine static and dynamic analysis with machine learning to identify key similarities.  Current results have indicated that the suggested design proposal, however theoretical, is both practical and useful. By comparing several samples or entire malware families and their indications against complex decision boundaries for logistic regression, we can demonstrate clear relation-ships between common metadata, such as context trig-gered piecewise hashes. This is further evidenced by the use of Jaccard indexes and sequence based similarities. However, the intended efficacy of these techniques varies widely depending on the implementation and the data types used. Using n-gram comparisons, the order with which certain behaviors were observed, is one such meth-od used to distill key features between samples.  Demonstrating n-grams extracted from malware execution threads  As such, the provided results represent a combination of all the research methods into one, open and seamless source, capable of accessing current analysis results and similar attributes, dictated by their relational metadata. De-spite the current results, future goals aim to introduce other techniques, such as Vagrant, Packer, Ansible, Chef, or Volatitiy, for deployment management and information dissemination across the platform. Literature Review  Ortiz introduces several novel applications of deployment software for content between local networks as well as guidelines for managing and creating flexible, dynamic virtual machines (2015). DiRaimondi provides guidance to analysts by reviewing concepts core to the Laika BOSS framework, integrating custom Yara rules for file-based detec-tions, and searching and filtering scan object metadata. He describes how to develop, test and implement new Laika BOSS modules to ex-tend and automate new functionality into the framework (2018). Fur-ther capability is gained when extended with machine learning con-cepts that allow these relationships and key indicators to identify fami-lies or similarities between samples (Saxe, 2018). The applied research provides for the implementation of several sys-tems to create a new web platform framework for analyzing binaries; it is defined by Django with MongoDB, Nginx, and Gunicorn on Ub-untu for the server-side rendering of client requests, Cuckoo for runtime behavioral analysis, Suricata and YARA based signature de-fining, NSRL querying for whitelisted MD5 hashes, and open-source intelligence via VirusTotal and AlienVault OTX. This allows for com-petent management of incoming web application requests and out-going, high-level, analytical data which will yield greater depth through the extraction of more trivial indicators. This open and collab-orative setting will allow other researchers to readily review and short-en the necessary time for investigations. 

Bust-A-Binary: Active Attribution and Analysis of Malware Campaigns

https://scholar.dsu.edu/cgi/viewcontent.cgi?article=1015&amp;context=research-symposium

Bust-A-Binary: Active Attribution and Analysis of Malware Campaigns

Abstract

Similar works

Full text

Available Versions

Beadle Scholar at Dakota State University