THE MANY DIMENSIONS OF RELATIONSHIPS

No ratings

Presented at ruxcon 2017 by

A presentation about how to use fuzzy executable and function similarity at scale. We will go over past approaches and why they failed. We will describe the general idea of fuzzy executable and function similarity and introduce the basic math concepts behind our approach. We will introduce concepts used for detection on executable and function level. We will show how "close relative" relationships between executables can aid analysts workflows. We will show how "distant relative" relationships can be identified via our approach and how they can be used. We will show how prevalence can be used to further strengthen the approach.