Comodemia

Dynamic Analysis, API Call Graph based techniques (Call Graph Clustering, Call Graph Similarities, etc..)

• Extracting call graphs from executable files using API Call sequences generated from Dynamic Analysis Sandboxing or using Static Analysis Disassembling techniques
• Implementation of different graph similarity techniques such as graph isomorphism, maximum common sub-graphs, minimum graph edit distance, etc..
• Clustering known malware samples using approximation algorithms like k-means clustering, DBSCAN clustering, etc..
• Classifying unknown samples using this clusters and implemented similarity comparison techniques

Dynamic Analysis, API Call Sequence based techniques

• Extracting call graphs from executable files using API Call sequences generated from Dynamic Analysis Sandboxing
• Categorizing API calls in to high level operation groups
• Implementation of API call sequence alignment technique (DNA sequence alignment, multiple sequence alignment, etc.)
• Implementation of techniques to recognize common patterns on generated sequences (longest Common Subsequence, Edit Distance, etc.)
• Revealing common call sequence patterns of different malware families
• Removing Sequence patterns seen on benign samples to minimize false positive rate.

Static Analysis, Opcode Sequence based techniques

• Op-code extraction from clean and malware samples
• To use Op-code Sequence information: Implementation of statistical classification techniques and training (using n-grams, Levenshtein / Euclidean distance, or other sequence similarity search techniques)
• To use Op-code Occurence information: Implementation of occurence generation and comparison techniques

New methods to combine Dynamic and Static Analysis results

• Combination of individual analysis results
• Performing hybrid analysis (using combined features gathered from both Static and Dynamic analysis)

Malicious Documents detection techniques (malicious JavaScript blocks on PDF samples, etc.

• Implementation of featur extraction techniques specific to each document type (PDF, MS document, etc.)
• Signature extraction using known malicious samples and signature based detection
• Heuristicaly classifying benign and malware samples

Active-learning Generic Signatures for specific malware families

• Implementation of signature extraction techinques(Static / Dynamic)
• On-the-fly learning form newly labeked / precisely detected malware samples(Learning could be improving existing classifiers, enhancing existing signatures, etc....)

Researching file reputation by statistic

Different statistic behaviours can be researched by criterions for file classification (malware, safe, system update etc.,). In study, differenet types of statistics: geo-distribution, frequency/time graphs, populating through subnets by time etc. can be used.

Fully automated signature generation based on machine learning models

• Dynamic Analysis, API Call Graph based techniques (Call Graph Clustering, Call Graph Similarities, etc.)
• Dynamic Analysis, API Call Sequence based techniques
• Static Analysis, Opcode Sequence based techniques
• New methods to combine Dynamic and Static Analysis results
• Active-learning Generic Signatures for specific malware families

Unpacking Techniques

• Dynamic Analysis, API Call Graph based techniques (Call Graph Clustering, Call Graph Similarities, etc.)
• Dynamic Analysis, API Sequence based techniques
• Static Analysis, Opcode Sequence based techniques
• Malicious Documents detections techniques (malicious JavaScript blocks on PDF samples, etc.)
• Active-learning Generic Signature for specific malware families

Creating an efficient and online clustering method based on fuzzy hash distance

There are fuzzy hash algorithms like nilsimsa and spamsum for detecting similarity between 2 text pieces. In order to detect similar bulk mails properly, we need to be able group (cluster) them based in a efficient way Since ASLab has continuous data flow, this module need to perform a stream clustering algorithm.

Anomaly detection in bulk mails

Spam/Phishing mail are usually sent in numbers. Howerver there are also legit mails, like newsletters, which are also sent in bulk. Creating patterns for legit bulk mails (by observing for a duration) and detecting out of the ordinary bulk mails will help creating alerts for suspecious behavior.