Slides (pdf) - Jesse Kornblum

More documents

Recommendations

Info

Features• Signed code?• Which APIs are called• How often APIs are called• Order in which APIs are called• Entropy• DLLs used• Percentage of code coverage• Magic strings• N-grams of instructions• Control-flow graph• IP addresses accessed• …Image courtesy of Flickr user doctor_keats and used under Create Commons license.18
• Clustering– Group of inputs which are close to each otherDistance Measures• Closeness depends on distance measure• What it sounds like– How far apart are the input programs?– As measured by our features• Alternatively, how similar are they?19
Page 1 and 2: Clustering and Classification forCy
Page 3 and 4: • Kyrus- Winston Wolf ofcomputer
Page 5 and 6: Similarity• What does it mean for
Page 7 and 8: Example7
Page 9 and 10: Current Tools• Cryptographic Hash
Page 11 and 12: Fuzzy Hashing• Compare signatures
Page 13 and 14: • Better algorithm for matching s
Page 15 and 16: Similar Programs• Similarity depe
Page 17: Features• What features can we ex
Page 21 and 22: Distance Measures21
Page 23 and 24: Distance MeasuresEntropyRepresent f
Page 25 and 26: Cosine SimilarityEntropyθThe small
Page 27 and 28: Comparisons• Can find programs si
Page 29 and 30: • Each program belongs to at most
Page 31 and 32: Clustering vs. ClassificationCluste
Page 33 and 34: Classification• User must create
Page 35 and 36: • Also used for spam detector- Al
Page 37 and 38: • Quick to classify, but slow to
Page 39 and 40: • Precision measures false positi
Page 41 and 42: • All of these are Free and Open
Page 43 and 44: Conclusion• Analyzing an infinite
Page 45: Questions?Jesse Kornblumjesse.kornb

Slides (pdf) - Jesse Kornblum

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?