Slides (pdf) - Jesse Kornblum

More documents

Recommendations

Info

Similar Programs• Do the same thing• Have the same look and feel• Connect to the same servers• Written by the same person• Used in the same intrusion• Run on the same platform16
Features• What features can we extract from a program?17
Page 1 and 2: Clustering and Classification forCy
Page 3 and 4: • Kyrus- Winston Wolf ofcomputer
Page 5 and 6: Similarity• What does it mean for
Page 7 and 8: Example7
Page 9 and 10: Current Tools• Cryptographic Hash
Page 11 and 12: Fuzzy Hashing• Compare signatures
Page 13 and 14: • Better algorithm for matching s
Page 15: Similar Programs• Similarity depe
Page 19 and 20: • Clustering- Group of inputs whi
Page 21 and 22: Distance Measures21
Page 23 and 24: Distance MeasuresEntropyRepresent f
Page 25 and 26: Cosine SimilarityEntropyθThe small
Page 27 and 28: Comparisons• Can find programs si
Page 29 and 30: • Each program belongs to at most
Page 31 and 32: Clustering vs. ClassificationCluste
Page 33 and 34: Classification• User must create
Page 35 and 36: • Also used for spam detector- Al
Page 37 and 38: • Quick to classify, but slow to
Page 39 and 40: • Precision measures false positi
Page 41 and 42: • All of these are Free and Open
Page 43 and 44: Conclusion• Analyzing an infinite
Page 45: Questions?Jesse Kornblumjesse.kornb

Slides (pdf) - Jesse Kornblum

Create successful ePaper yourself

Delete template?

Save as template?