2011
Using Machine Learning to Detect Malware Similarity
Machine Learning , Malware , SEI Research 1 Comment »By Sagar Chaki, Senior Member of the Technical Staff
Research, Technology, and System Solutions 
Malware,
which is short for “malicious software,” consists of programming aimed
at disrupting or denying operation, gathering private information
without consent, gaining unauthorized access to system resources, and
other inappropriate behavior. Malware infestation is of increasing
concern to government and commercial organizations. For example,
according to the Global Threat Report from
Cisco Security Intelligence Operations, there were 287,298 “unique
malware encounters” in June 2011, double the number of incidents that
occurred in March. To help mitigate the threat of malware, researchers
at the SEI are investigating the origin of executable software binaries
that often take the form of malware. This posting augments a previous posting
describing our research on using classification (a form of machine
learning) to detect “provenance similarities” in binaries, which means
that they have been compiled from similar source code (e.g., differing
by only minor revisions) and with similar compilers (e.g., different
versions of Microsoft Visual C++ or different levels of optimization).
Recent Comments