PIN DOWN THE MALWARE: USING MACHINE LEARNING TECHNIQUES TO AUGMENT IOCS

No ratings

Presented at Mircon 2014 by

Andrei Saygo

Jason Coleman

Most IOCs (Indicators of Compromise) are based on how a malicious file interacts with a system or static information that describes a file at rest (e.g. file name, size, PE sections, imports/exports, etc.). But some information is not available because it does not leave a trace on the host file system. This session will look at ways we can leverage PIN, the dynamic binary instrumentation framework, to automatically detect malicious programs. We will demo a PIN plugin that is able to dynamically instrument instructions and APIs to extract information that is either unavailable or is difficult to obtain. We will show how the plugin can augment the use of IOCs and through the use of machine learning techniques, automatically detect and classify malicious programs.