U tweetove putem weba ili aplikacija drugih proizvođača možete dodati podatke o lokaciji, kao što su grad ili točna lokacija. Povijest lokacija tweetova uvijek možete izbrisati. Saznajte više
1\ Surprisingly, you could build a very mediocre PE malware detector with a single PE feature: the PE compile timestamp. In fact, I built a little random forest detector that uses only the timestamp as its feature that gets 62% detection on previously unseen malware at a 1% FPR.
2\ The timestamp field poses a low-key problem for attackers. If they leave the compiler-assigned value they reveal telling details. If they assign a concocted value, their tampering can make them easier to detect. Here's an 'allaple' malware set's random, insane timestamps:pic.twitter.com/D0XIRGpnjw
3\ Now let's look at a big malware dataset's compile timestamp behavior. Notice the straight horizontal lines. Those are unique polymorphic hashes reusing the *same* compile timestamp month after month. Also, notice the number of insane back-to-the-future timestamps.pic.twitter.com/dW4EZmHzfI
4\ In contrast, benign files' timestamp behavior is far more well behaved. That line at 1993 is a special case: Delphi binaries all have that timestamp field setting, regardless of when they were created.pic.twitter.com/pzeUjeDOHG
5\ From an ML and signatures perspective, the detection signal here comes from two places: 1) there are exact-match timestamps that allow us to detect entire toolkits and polymorphic families. 2) Pathological timestamps are far more likely to come from malware.
6\ The timestamp field has a non-linear (to say the least) but high mutual information relationship with the bad/good labels. Decision trees are a natural modeling fit here. Here's the ROC curve we get when we fit a random forest detector on just the timestamp feature.pic.twitter.com/VDeYde1e16
In recent .NET code that timestamp field is by default filled with a hash of the contents, to produce deterministic binaries
@threadreaderapp please do your magic
Good analysis . keep up the good work to make the world a better place
Interesting post about PE timestamps and Win 10 binarieshttps://devblogs.microsoft.com/oldnewthing/20180103-00/?p=97705 …
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.
