Battling Unknown Malware with Machine Learning

1. BATTLING UNKNOWN MALWARE WITH MACHINE LEARNING DR. SVEN KRASSER CHIEF SCIENTIST @SVENKRASSER

13. LET’S CLASSIFY “Buttock Circumference” [mm] Weight[10-1 kg] • Let’s assume we want to detect males (blue) • I.e. “blue” is our positive class • TP: classify blue as blue • Note some misclassifications • FP: classify red as blue • FN: classify blue as red 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

18. “Buttock Circumference” [mm] Weight[10-1 kg] 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. LET’S CLASSIFY • Get more “blue” right (true positives) • Get more “red” wrong (false positives) 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

24. Source: https://commons.wikimedia.org/w/index.php?curid=2257082

28. FILE ANALYSIS AKA Static Analysis • THE GOOD – Relatively fast – Scalable – No need to detonate – Platform independent, can be done at gateway • THE BAD – Limited insight due to narrow view – Different file types require different techniques – Different subtypes need special consideration – Packed files – .Net – Installers – EXEs vs DLLs – Obfuscations (yet good if detectable) – Ineffective against exploitation and malware-less attacks – Asymmetry: a fraction of a second to decide for the defender, months to craft for the attacker 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

30. EXAMPLE FEATURES 32/64 BIT EXECUTABLE GUI SUBSYSTEM COMMAND LINE SUBSYSTEM FILE SIZE TIMESTAMP DEBUG INFORMATION PRESENT PACKER TYPE FILE ENTROPY NUMBER OF SECTIONS NUMBER WRITABLE NUMBER READABLE NUMBER EXECUTABLE DISTRIBUTION OF SECTION ENTROPY IMPORTED DLL NAMES IMPORTED FUNCTION NAMES COMPILER ARTIFACTS LINKER ARTIFACTS RESOURCE DATA EMBEDDED PROTOCOL STRINGS EMBEDDED IPS/DOMAINS EMBEDDED PATHS EMBEDDED PRODUCT META DATA DIGITAL SIGNATURE ICON CONTENT … 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

37. THREAT SOPHISTICATION MALWARE NON-MALWARE ATTACKS MALWARE 40% NATION- STATES 60% NON-MALWARE ATTACKS ORGANIZED CRIMINAL GANGS HACKTIVISTS/ VIGILANTES TERRORISTS CYBER- CRIMINALS YOU NEED COMPLETE BREACH PREVENTION HARDERTOPREVENT &DETECT LOW HIGH HIGH LOW 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

41. KEY POINTS • Machine Learning is an effective tool against unknown malware • Try it out on VirusTotal • Trading off true positives and false positives • Detecting 99% malware means an APT has a 100% chance of getting malware into your environment • The majority of intrusions are not malware- based • Avoid silent failure • Use a comprehensive array of techniques 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.

Battling Unknown Malware with Machine Learning

Du liest eine Vorschau.

Hier ansehen

Battling Unknown Malware with Machine Learning

Weitere Verwandte Inhalte

Diashows für Sie (20)

Andere mochten auch (10)

Ähnlich wie Battling Unknown Malware with Machine Learning (20)

Weitere von CrowdStrike (8)

Aktuellste (20)