Enhancing CTI Processes with Code Search Technology
summary
A code-search engine that decomposes binaries into functions and does bindiff at scale claims resilient family identification by matching large subsets of functions rather than hashes. The prototype indexes millions of files (database ~100 million binaries), tracks 1500+ malware families, and returns real-time results; examples show an 80% match to VSingle, a 51% match linking a broken memory dump to Lazarus, and detection of modified mimikatz variants that bypass AV. Requires unpacking and library filtering.
AI-written summary · about
chapters (7)
- 0:00Introduction to code search
- 2:07Defining binary similarity
- 4:50Malware identification use case
- 10:07Demonstrating mutation bypass
- 16:42Making OSINT searchable
- 22:33Technical challenges and takeaway
- 25:40Q&A session
related talks
25mEnhancing Malware Code Similarity Detection through Vectorsearch and TLSH
20mDevX: History of Code Search
57mCode Genome - Fingerprinting Code to Build Trustworthy SBOMs
41mfn_fuzzy: Fast Multiple Binary Diffing Triage With IDA
16mCodeExtract: Enhancing Binary Code Similarity Detection with Code Extraction Techniques
39mSelect Bugs From Binary Where Pattern Like CVE-1337-Days
45m"Advanced Malware Threat: handling obfuscated code using..."
27mBinSim: Trace-based Semantic Binary Diffing...