Slides (pdf) - Jesse Kornblum

More documents

Recommendations

Info

Classification Systems• Academia– “Solved problem”• eDiscovery– They love this stuff– Predictive coding– Features are n-grams of text• For you?– Some assembly required– Your Agency puts it together42
Conclusion• Analyzing an infinite number of programs– Only five minutes per sample– Computer time is cheap• Which of these programs are similar to each other?– Build clusters of programs• Which of these programs fit into existing categories?– Variant of {Zeus|Spybot|Blackhole}– Written by Evil D. Hacker?– Related to the last intrusion?– Build classifiers for these categories43
Page 1 and 2: Clustering and Classification forCy
Page 3 and 4: • Kyrus- Winston Wolf ofcomputer
Page 5 and 6: Similarity• What does it mean for
Page 7 and 8: Example7
Page 9 and 10: Current Tools• Cryptographic Hash
Page 11 and 12: Fuzzy Hashing• Compare signatures
Page 13 and 14: • Better algorithm for matching s
Page 15 and 16: Similar Programs• Similarity depe
Page 17 and 18: Features• What features can we ex
Page 19 and 20: • Clustering- Group of inputs whi
Page 21 and 22: Distance Measures21
Page 23 and 24: Distance MeasuresEntropyRepresent f
Page 25 and 26: Cosine SimilarityEntropyθThe small
Page 27 and 28: Comparisons• Can find programs si
Page 29 and 30: • Each program belongs to at most
Page 31 and 32: Clustering vs. ClassificationCluste
Page 33 and 34: Classification• User must create
Page 35 and 36: • Also used for spam detector- Al
Page 37 and 38: • Quick to classify, but slow to
Page 39 and 40: • Precision measures false positi
Page 41: • All of these are Free and Open
Page 45: Questions?Jesse Kornblumjesse.kornb

Slides (pdf) - Jesse Kornblum

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?