Navigating and visualizing the malware intelligence space

摘要

There is now a shift from traditional Cyber Security to Cyber Intelligence. We are only beginning to leverage the intelligence that can be extracted from the thousands of malware samples that are currently being gathered on a daily basis. By automatically creating analysis reports for each of these malware samples, it is possible to improve our understanding of the current cyber security situation on the Internet and of how malware evolves over time. However, research is still required in order to extract, summarize, and present this information to leverage its full potential. In this article, we present two approaches to navigate and visualize what we call the Malware Intelligence Space (i.e., the documentation of millions of malware samples). The first approach, called BeAVER, was built to navigate the Malware Intelligence Space. The second approach, called Malware Threat Radar, was designed to visualize relationships between malware samples and their evolution over time. We also present the technological detail of our implementation prototypes.