MalViC is an addon for the automatic analysis of malware behavior (program behavior recorded from malicious software in GFISandbox). It has been designed to support the regular analysis of malicious software and the development of detection and defense measures. MalViC allows for identifying novel classes of malware with similar behavior and assigning unknown malware to discovered classes.
MalViC builds on the concept of dynamic analysis: Malware binaries are collected in the wild and executed in GFISandbox, where their behavior is monitored during run-time. The execution of each malware binary results in a report of recorded behavior. MalViC analyzes these reports for discovery and discrimination of malware classes using machine learning.
Extraction of prototypes
From a given set of reports, MalViC identifies a subset of prototypes representative for the full data set. The prototypes provide a quick overview of recorded behavior and can be used to guide manual inspection.
Clustering of behavior
MalViC automatically identifies groups (clusters) of reports containing similar behavior. Clustering allows for discovering novel classes of malware and provides the basis for crafting specific detection and defense mechanisms, such as anti-virus signatures.
Classification of behavior
Based on a set of previously clustered reports, MalViC is able to assign unknown behavior to known groups of malware. Classification enables identifying novel variants of malware and can be used to filter program behavior prior to manual inspection.
Incremental analysis.
MalViC can be applied incrementally for analysis of large data sets. By processing reports in chunks, run-time and memory requirements are significantly reduced. This renders long-term application feasible, for example for daily analysis of incoming malware.
Visualization.
The human eye is well trained to spot similarities in images. Therefore, the all behavior reports as well as all cluster and classification results are visualized within the MalViC webinterface, which can easily be integrated into existing existing interfaces.
