Data mining approaches in malware analysis

在过去的几年里，随着我们越来越多地转向互联网来寻求商业和娱乐，网络罪犯和其他怀有恶意的人也是如此。无论是不分青红皂白地针对全球计算机及其用户的大规模网络钓鱼行动，还是旨在危害机密信息或关键系统完整性的复杂定向攻击，从经济和地缘政治的角度来看，这些行动的后果都是深远和严重的。不幸的是，我们对这些现象缺乏了解。虽然学术界、工业界和政府的安全专家一直在检测和分析其中一些威胁，但所采用的方法往往给我们留下了许多悬而未决的问题，涉及归属(谁在做这件事)、作案手法(他们是如何做的)和影响(他们做了多少)。回答这些问题是能够设计和部署适当的反措施和战略的关键，这些措施和战略将帮助我们减轻我们时代的这一祸患。该项目旨在通过大规模收集恶意软件感染的数据并应用数据挖掘技术来解决这一问题，以便发现隐藏的模式，这些模式可能有助于我们确定谁在对谁做什么、如何做、做多少以及可能的原因。为此，我们将依靠反病毒软件公司ESET加拿大研发部门ESET和魁北克省警察部队Surete Du魁北克的支持和专业知识。人们希望，开发的分析方法最终将有助于行业和政府机构监测、检测、了解并可能制定出对此类恶意活动的适当反应。

In the last few years, as we have increasingly turned to the Internet for business and pleasure, so have cybercriminals and others with malicious intent. Whether it is in large-scale phishing campaigns that indiscriminately target computers and their users worldwide, or sophisticated targeted attacks that aim to compromise confidential information or the integrity of critical systems, the consequences of these actions are profound and severe both from an economical and geopolitical point of view. Unfortunately, our understanding of these phenomena is lacking. While security experts in academia, industry and government have been detecting and analyzing some of these threats, the methods employed often leave us with many unanswered questions with respect to attribution (who is doing it), modus operandi (how they are doing it), and impact (how much are they doing it). Answering these questions is key to be able to design and deploy adequate counter-measures and strategies that will help us abate this plague of our time. This project aims to address this problem by gathering data on malware infections on a massive scale and applying data mining techniques in order to discover hidden patterns that might help us identify who is doing what to whom, how, how much and potentially why. For this we will count on the support and expertise of ESET Canada, the Canadian R&D branch of the anti-virus software company ESET, and the Surete du Quebec, the provincial police force of the Province of Quebec. It is hoped that the analysis methods developed will eventually help industry and government agencies monitor, detect, understand and potentially develop adequate responses to such malicious activities.