A Scalable, Ensemble Approach for Building and Visualizing Deep Code-Sharing Networks

on YouTube ↗22m

" summary

An ensemble system estimates code sharing by combining instruction engrams, dynamic API traces, PE/header and byte-sequence features, and then compresses counts with an approximate feature counting plus feature-hashing trick so feature extraction and lookup run on commodity hardware. A probabilistic nearest-neighbor index avoids quadratic all-pairs comparisons, returning only high-probability matches. Evaluated by MIT Lincoln Laboratories against four competitors and scoring highest, the pipeline ships with a Python ML library and a web-based visualization for exploring millions of malware binaries.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 5:43Great, but why should we care about malware similarity networks?
3. 9:01Problem 2: Scale
4. 11:40Here's what it looks like when we compute the bag of features model using PE header features
5. 15:58Our third innovation

" related talks

• 31mAn AI Approach to Malware Similarity Analysis: Mapping the Malware Genome With a Deep Neural NetworkKonstantin Berlin · Black Hat USA 2016
• 30mData Driven SecurityPeter Elmer · stackconf online 2021
• 30mEnhancing CTI Processes with Code Search TechnologyCarlos Rubio, Jonas Wagner · FIRST Cyber Threat Intelligence Symposium 2022
• 40mDemystifying File Similarity for Malware DetectionUdbhav Prasad · BSidesSF 2026
• 25mEnhancing Malware Code Similarity Detection through Vectorsearch and TLSHRemco Sprooten · 2024 FIRST Cyber Threat Intelligence Conference
• 31mUsing Math to Speed Up Security Assessments of Windows ExecutablesCole Thompson · BSidesSF 2018
• 44mApplied Machine Learning for Data Exfil and Other Fun TopicsMatt Wolff, Brian Wallace, Xuan Zhao · Black Hat USA 2016
• 16mCodeExtract: Enhancing Binary Code Similarity Detection with Code Extraction TechniquesChenggang Wu, Zhe Wang, Lichen Jia, Peihua Zhang · LCTES 2024