A Technical History of the SEI

understand the relationship among the various groups in the community. They defined the following
plan of work and are implementing it successfully.
1. Bring reverse engineers together in workshops, training, and mentoring sessions to allow
them to learn from each other and to increase the skills and capabilities of reverse engineers
with less experience. The team held its first invitational Malicious Code Workshop in October
2004 to discuss the top challenges in malware. By 2012, they had held seven Malicious Code
Workshops and seven Malicious Code Training Workshops, the latter focusing on sharing
analysis techniques.
2. Build a set of tools and processes to collect malicious code and make that collection available
to collaborators so that the number of collection infrastructures can be minimized, particularly
within the U.S. government. A catalog of malicious code and analysis processes was developed
and is available to malware analysts and researchers. Development and analysis continue.
The limited-access Artifact Catalog contained more than 80 million files in January
2013, with typically a million new samples ingested weekly.
3. Automate as many analysis functions as possible so limited resources can be spent on only
the novel and the most important malware samples. Reverse engineering is a time-consuming
technique—an analyst dissects every instruction in the malware. The SEI malware experts
have codified some of their reverse engineering expertise into automated tools, which they
share with other analysts in the DoD and intelligence community. The SEI analysts use the
tools themselves for research and to fulfill requests from government agencies. The team refines
the tools and develops additional ones in the process [Householder 2011; Cohen 2009,
2010].
The Consequence: Faster Response to Malicious Code Attacks, Better
Control
Malware analysts at government operation centers have advanced tools, shortening their response
times; they also have specialized analytical support from the SEI through the CERT/CC artifact
analysis team. The Artifact Catalog provides them with an extensive collection of malicious code
that supports trending and related research. The automated tools significantly decrease analysis
time and enable analysts and researchers to be increasingly effective at identifying and understanding
malicious code—understanding that is essential to gaining control over attacks and limiting
the damage they cause. The result is increased safety for U.S. government and agency systems.
By providing analysis and serving as expert witnesses [Poulsen 2008, Ove 2010, Cruz 2011], SEI
malicious code experts have helped to shut down and apprehend a major identity theft and fraud
ring, whose activities caused more than $4 million in losses, and helped convict a perpetrator of
wire fraud that cost financial institutions an estimated $86 million [Mills 2009].
The SEI Contribution
The SEI Malicious Code team has collaborative relationships with both the DoD and the intelligence
community. Because of the CERT/CC malware work, SEI collaborators and sponsors have
the tools and education needed to streamline analysis and more quickly answer specific questions.
The SEI has been a resource to build new capabilities in the U.S. government. Its malware experts
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 174
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.