Joshua Saxe

@joshua_saxe

Chief Scientist @ Sophos (views my own). Book: Malware Data Science. Recent paper: …. Interested in ML, cyber, social-sci, philosophy

malwaredatascience.com
Vrijeme pridruživanja: svibanj 2013.

Medijski sadržaj

  1. prije 11 sati

    Another visualization of "malware mordor" (110k sample malware dataset), this time via printable string minhashes used as indices into a 2d histogram. Lots of cluster structure. If I was more inspired I'd photoshop a victim operating system getting grilled over these flames :)

    13 korisnika označava da im se sviđa
  2. prije 11 sati

    Two attempts to visualize the topology of "malware mordor" -- 110k malware samples random-projected onto a 2d surface, histogrammed to show concentration. Malware datasets contain huge volumes of near-duplicate binaries (~60%?). You can see that pretty clearly here.

    1 proslijeđeni tweet 8 korisnika označava da im se sviđa
  3. prije 23 sata

    v0.2 of my security learning model thanks to feedback from and . It's part of what makes security so exhilarating that many conversations (e.g. strategy around designing a threat response operation) require every layer as part of the conversation.

    3 proslijeđena tweeta 19 korisnika označava da im se sviđa
  4. 5. velj

    Malware analysis by poking the malware: We run malware, and then run it again with added stimulus (eg keystrokes). Events that *only* occur with stimulus are high-signal and telling. I did the viz part, the paper authors did everything else.

    1 proslijeđeni tweet 9 korisnika označava da im se sviđa
  5. 4. velj
    Odgovor korisnicima

    ... my team and I were funded under that program. One could have a philosophical debate about the 'genetic' metaphor but it proved operationally useful. We had two comp bio scientists on our team who transferred modeling methods from biology to malware in ways we found useful.

    1 reply 2 korisnika označavaju da im se sviđa
  6. 3. velj

    1\ Here's what a Yara-ified ML decision tree for OSX/Mach-O malware detection looks like. The full random forest is 3903 lines of Yara, computes @ 3ms per CPU per binary, and gets 67% detection @ 0.2% false positive rate. Will push to YaraML GitHub once results improve a bit.

    3 proslijeđena tweeta 22 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  7. 1. velj

    Some infosec knowledge is useful for months (knowledge of a given campaign), other knowledge, for years, (TTPs), other knowledge, for decades (the halting problem). Here's a "Pyramid of Pain" (cc/ ) inspired model of knowledge in cyber I find useful for myself.

    55 proslijeđenih tweetova 130 korisnika označava da im se sviđa
  8. 1. velj

    1\ Malware sandboxes are useful but extremely limited. Here's a malware call graph, and in red are the functions the malware actually *executed* when run in a sandbox -- a miniscule fraction of the malware's potential badness!

    10 replies 43 proslijeđena tweeta 110 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  9. 1. velj

    Useful summary of known/best-guess information about the coronavirus from the NYTimes

    1 korisnik označava da mu se sviđa
  10. 1. velj
    Odgovor korisniku/ci

    For sure, that's apparent just from eyeballing this chart.

    1 reply 1 proslijeđeni tweet 10 korisnika označava da im se sviđa
  11. 31. sij

    A genealogy of 10 malware EXEs that share code - and one that doesn't belong - visualized. The rows are individual samples, and the color-blocks are their functions. A somewhat complicated algorithm is used to draw a plausible evolutionary lineage. Work from my CyberGenome days.

    2 proslijeđena tweeta 11 korisnika označava da im se sviđa
  12. 31. sij

    For a non-mathy thorough intro to ML detection, Chapter 6 of and my book is available for free on the site. Goes through logistic regression, kNN, decision trees, random forests, and when it makes sense to use each.

    6 korisnika označava da im se sviđa
  13. 30. sij

    5\ The result, as would be intuitive, is much better detection accuracy. Please see the paper for more info!

    2 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  14. 30. sij

    4\ These analyses are then merged so that reasoning about the file path in the context of the binary, and vice-versa, can take place. Good targets for detection are, for example, unsigned system utilities that have been replaced by very different looking files.

    1 reply 2 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  15. 30. sij

    3\ And a character string / file path analyzer, which does a high-capacity analysis of file path strings...

    1 reply 1 proslijeđeni tweet 2 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  16. 30. sij

    2\ Their neural network has two components: a file analyzer, shown in the image below, which does a high-capacity, non-linear analysis of a file's features...

    1 reply 1 korisnik označava da mu se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  17. 30. sij

    1\ A file seen at "Downloads\svchost.exe" that doesn't *look* like svchost.exe *might* be a problem. Indeed, AI's , and show that a neural net that takes a file's path alongside its contents gets ~30% better detection.

    1 reply 5 proslijeđenih tweetova 11 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  18. 30. sij

    Large scale malware similarity visualization work by , myself, and others. We built a prototype set of analytics and accompanying GUI to accelerate malware analysis over many samples, and did a user study showing efficacy.

    1 reply 11 proslijeđenih tweetova 30 korisnika označava da im se sviđa
  19. 29. sij

    2\ I've put a PoC powershell logistic regression rule up at the github link. Idea here is by Yara-ifing ML we make ML more transparent--the ML logic is right there in the text. And we allow blue teams to mix and match ML rules with signatures, and quickly swap in new models.

    1 reply 7 proslijeđenih tweetova 18 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  20. 29. sij

    1\ I've written a little compiler to ship ML models as standalone Yara rules, and done proof of concept detectors for Macho-O, RTF files, and powershell scripts. So far I have decision trees, random forests, and logistic regression (LR) working.

    15 replies 104 proslijeđena tweeta 253 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit

@joshua_saxe još nije poslao/la nijedan tweet s fotografijama ili videozapisima.

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·