Multi-dimensional Malware Similarity will let you Catch Up with Malware Developers
No ratings
Presented at FirstConferenceKualaLumpur 2018 by
The speaker will talk about the importance of multi-dimensional similarity between malware pieces and how it can change your malware analysis workflow and the game between you and malware developers. We have named the system to calculate multi-dimensional similarity “Sample Similarity Scoring System” and we will refer it as S4 in what follows. We will also describe a couple of successful S4 applications to real pieces of malware Some of the problems malware analysts encounter are: More and more malware pieces are developed and deployed and it has become very difficult to keep up with the pace of increasing malware pieces Some malware has anti-sandbox capabilities to evade its detection by sandboxes Some software provides a "malicious score" for malware, but the score does not help how to proceed with malware analysis. When an analyst encounters a new piece of malware, she first needs to determine the type of malware so that she can come up with an appropriate analysis procedure. Is it one of RATs, ransomware, a simple downloader, or totally a new kind? This is the first step of analysis and time-consuming, but it is critical and needs to be done right as it will affect the later analysis stages. If she can determine which past malware is similar to the new malware, she can leverage the knowledge and her past analysis workflow to tackle the new one. Some analysts utilize similarity tools like sdhash or ssdeep to determine the similarity of the new piece of malware to the malware pieces that they have analyzed before and/or famous malware families. However, this approach has one drawback, that is, malware developers have learned to evade their malware’s being detected of malware’s similarity to their past work. This is where “multi-dimensional” similarity comes to rescue. S4 employs more than 10 similarity tools/algorithms to calculate similarity scores between the new piece of malware and those malware pieces already in the S4 system. (Similarity tools and algorithms include fuzzy hashes, entry point, binary entropy, and our original algorisms based on Called APIs, Called DLLs, and their sequences.) However, it would be difficult for human analysts to interpret all the individual scores, so the S4 system summarizes those scores into (currently) three dimensions, namely, surface analysis, dynamic analysis, and geometric analysis similarity scores. Even if malware developers have managed to manipulate a couple of similarity scores, it would be extremely difficult for them to defeat all the tools and algorithms. Other S4 merits include: An S4 instance can share past malware analysis results by files (currently in our proprietary file format, but STIX 2.x format planned for future) with another S4 instance to calculate the similarity scores of the new malware against past malware pieces from the original S4 instances (as well as those from itself). Even if a new piece of malware has anti-sandbox capabilities, S4 may be able to determine it similarity to the past malware pieces through its evasive behavior. Actually S4 has successfully determined one piece of malware to be in the WannaCry family through this evasive behavior similarity even though all the other similarity methods failed.