Data mining approaches in malware analysis

在过去的几年里，随着我们越来越多地转向互联网进行商业和娱乐，网络犯罪分子和其他怀有恶意的人也开始使用互联网。无论是大规模的网络钓鱼活动，不分青红皂白地针对全球的计算机及其用户，还是复杂的有针对性的攻击，旨在破坏机密信息或关键系统的完整性，从经济和地缘政治的角度来看，这些行为的后果都是深刻而严重的。不幸的是，我们对这些现象的理解是缺乏的。虽然学术界、工业界和政府的安全专家一直在检测和分析其中的一些威胁，但所采用的方法往往给我们留下了许多未解决的问题，包括归因（谁在做）、操作方式（他们如何做）和影响（他们做了多少）。回答这些问题是能够设计和部署适当的应对措施和战略的关键，这些措施和战略将帮助我们减轻这个时代的瘟疫。这个项目旨在通过大规模收集恶意软件感染的数据和应用数据挖掘技术来解决这个问题，以便发现隐藏的模式，这些模式可能有助于我们确定谁在对谁做什么，如何做，做多少以及潜在的原因。为此，我们将依靠杀毒软件公司ESET的加拿大研发分公司ESET Canada和魁北克省警察部队Surete du Quebec的支持和专业知识。人们希望开发的分析方法最终将帮助行业和政府机构监测、检测、理解并可能对此类恶意活动做出适当的反应。

In the last few years, as we have increasingly turned to the Internet for business and pleasure, so have cybercriminals and others with malicious intent. Whether it is in large-scale phishing campaigns that indiscriminately target computers and their users worldwide, or sophisticated targeted attacks that aim to compromise confidential information or the integrity of critical systems, the consequences of these actions are profound and severe both from an economical and geopolitical point of view. Unfortunately, our understanding of these phenomena is lacking. While security experts in academia, industry and government have been detecting and analyzing some of these threats, the methods employed often leave us with many unanswered questions with respect to attribution (who is doing it), modus operandi (how they are doing it), and impact (how much are they doing it). Answering these questions is key to be able to design and deploy adequate counter-measures and strategies that will help us abate this plague of our time. This project aims to address this problem by gathering data on malware infections on a massive scale and applying data mining techniques in order to discover hidden patterns that might help us identify who is doing what to whom, how, how much and potentially why. For this we will count on the support and expertise of ESET Canada, the Canadian R&D branch of the anti-virus software company ESET, and the Surete du Quebec, the provincial police force of the Province of Quebec. It is hoped that the analysis methods developed will eventually help industry and government agencies monitor, detect, understand and potentially develop adequate responses to such malicious activities.