Malheur - Tool For Malware Analysis

Malheur - Automatic Analysis of Malware Behavior




Extraction of prototypes: From a given set of reports, Malheur identifies a subset of prototypes representative for the full data set. The prototypes provide a quick overview of recorded behavior and can be used to guide manual inspection.

Clustering of behavior: Malheur automatically identifies groups (clusters) of reports containing similar behavior. Clustering allows for discovering novel classes of malware and provides the basis for crafting specific detection and defense mechanisms, such as anti-virus signatures.

Classification of behavior: Based on a set of previously clustered reports, Malheur is able to assign unknown behavior to known groups of malware. Classification enables identifying novel variants of malware and can be used to filter program behavior prior to manual inspection.

Incremental analysis: Malheur can be applied incrementally for analysis of large data sets. By processing reports in chunks, run-time and memory requirements are significantly reduced. This renders long-term application feasible, for example for daily analysis of incoming malware.

No comments

Powered by Blogger.