SAD THUG...
summary
SAD THUG detects malware hiding data in image file structure by modeling clean files as a finite-state automaton and flagging structural deviations; trained on ~313,000 images (about 270,000 JPEGs and 43,000 PNGs) it achieves around 99.24% TPR and 99.323% TNR for JPEGs and ~99.318% TPR/98.88% TNR for PNGs. Implementation beats signature tools like StegDetect on structural methods, requires parseable structured formats, and notes poisoning of training data as the main limitation.
AI-written summary · about
chapters (4)
related talks
30mData Driven Security
28mMem2Img: Memory-Resident Malware Detection via Convolution Neural Network
18mFingerprinting Web Application Platforms by Variations in PNG Implementations
30mTracking Threat Actors Using Images: A Hunting & Analysis Approach
47m Natural Language Processing & Anomaly detection in Sys call logs
50mDeep Impact: Recognizing Unknown Malicious Activities from Zero Knowledge
44mUnmasking APTs: An Automated Approach for Real-World Threat Attribution
28mBeyond AV: Detection-Oriented File Analysis