Data mining approaches in malware analysis

点击翻译按钮获取中文摘要

In the last few years, as we have increasingly turned to the Internet for business and pleasure, so have cybercriminals and others with malicious intent. Whether it is in large-scale phishing campaigns that indiscriminately target computers and their users worldwide, or sophisticated targeted attacks that aim to compromise confidential information or the integrity of critical systems, the consequences of these actions are profound and severe both from an economical and geopolitical point of view. Unfortunately, our understanding of these phenomena is lacking. While security experts in academia, industry and government have been detecting and analyzing some of these threats, the methods employed often leave us with many unanswered questions with respect to attribution (who is doing it), modus operandi (how they are doing it), and impact (how much are they doing it). Answering these questions is key to be able to design and deploy adequate counter-measures and strategies that will help us abate this plague of our time. This project aims to address this problem by gathering data on malware infections on a massive scale and applying data mining techniques in order to discover hidden patterns that might help us identify who is doing what to whom, how, how much and potentially why. For this we will count on the support and expertise of ESET Canada, the Canadian R&D branch of the anti-virus software company ESET, and the Surete du Quebec, the provincial police force of the Province of Quebec. It is hoped that the analysis methods developed will eventually help industry and government agencies monitor, detect, understand and potentially develop adequate responses to such malicious activities.