SciELO - Scientific Electronic Library Online

 
vol.15 número2PROCEDURES, METHODS AND/OR GOOD PRACTICES TO DESIGN PRIVATE CLOUDSOPTIMAL OVERHEAD DISTRIBUTION NETWORK PLANNING BASED GRAPH THEORY índice de autoresíndice de assuntospesquisa de artigos
Home Pagelista alfabética de periódicos  

Serviços Personalizados

Artigo

Indicadores

Links relacionados

  • Em processo de indexaçãoCitado por Google
  • Não possue artigos similaresSimilares em SciELO
  • Em processo de indexaçãoSimilares em Google

Compartilhar


Iteckne

versão impressa ISSN 1692-1798

Resumo

USECHE-PELAEZ, David Esteban; SEPULVEDA-ALZATE, Daniela; DIAZ-LOPEZ, Daniel Orlando  e  CABUYA-PADILLA, Diego Edison. BUILDING MALWARE CLASSIFICATORS USABLE BY STATE SECURITY AGENCIES. Iteckne [online]. 2018, vol.15, n.2, pp.107-121. ISSN 1692-1798.  http://dx.doi.org/10.15332/iteckne.v15i2.2072.

Sandboxing has been used regularly to analyze software samples and determine if these contain suspicious properties or behaviors. Even if sandboxing is a powerful technique to perform malware analysis, it requires that a malware analyst performs a rigorous analysis of the results to determine the nature of the sample: goodware or malware. This paper proposes two machine learning models able to classify samples based on signatures and permissions obtained through Cuckoo sandbox, Androguard and VirusTotal. The developed models are also tested obtaining an acceptable percentage of correctly classified samples, being in this way useful tools for a malware analyst. A proposal of architecture for an IoT sentinel that uses one of the developed machine learning model is also showed. Finally, different approaches, perspectives, and challenges about the use of sandboxing and machine learning by security teams in State security agencies are also shared.

Palavras-chave : Cuckoo sandbox; data science; machine learning; malware analysis; sandboxing.

        · resumo em Espanhol     · texto em Inglês     · Inglês ( pdf )