Visual classification according to binary memory dump
There is disclosed in one example a method of detecting computer malware, including: receiving a binary object for analysis; allocating the binary object to a sandbox; within the sandbox, loading the binary object into an executable memory region; performing a memory dump of the executable memory region; and analyzing the memory dump for malware characteristics.
1. A method of detecting computer malware, comprising:
receiving a compressed binary object for analysis;
allocating the compressed binary object to a sandbox;
within the sandbox, unpacking the compressed binary object into an unpacked binary object and loading the unpacked binary object into an executable memory region;
performing a core dump of the executable memory region; and
performing a computer vision analysis of the core dump to determine malware characteristics.
2. The method of claim 1 , wherein performing the computer vision analysis of the core dump comprises artificial intelligence analysis.
3. The method of claim 1 , further comprising converting the core dump to an image.
4. A computing system, comprising:
a processor;
a memory; and
instructions encoded within the memory to instruct the processor to:
receive a compressed malware sample for analysis;
cause a sandbox to receive the compressed malware sample, decompress the compressed malware sample into a local memory of the sandbox, and dump the decompressed malware sample to a binary memory image;
cause the binary memory image to be converted to an image file; and
cause a neural network to visually inspect the image file, and based on visual inspection, make a determination on whether the compressed malware sample is malicious.
5. The computing system of claim 4 , wherein the visual inspection of the image file by the neural network comprises artificial intelligence analysis.
6. The computing system of claim 5 , wherein the artificial intelligence analysis comprises computer vision.
7. The computing system of claim 4 , wherein the image file is an 8-bit grayscale image.
8. The computing system of claim 4 , wherein converting the binary memory image to an image file comprises converting the binary memory image to an 8-bit vector format.
9. The computing system of claim 4 , wherein the sandbox runs a native operating system of the compressed malware sample.
10. The computing system of claim 4 , wherein unpacking the compressed malware sample into the local memory comprises operating an unpacker.
11. The computing system of claim 10 , wherein the unpacker is an operating system-native unpacker.
12. The computing system of claim 4 , wherein the compressed malware sample is a compressed Windows portable executable (PE).
13. The computing system of claim 4 , wherein the compressed malware sample is a compressed Unix or Linux executable and linkable format (ELF) file.
14. The computing system of claim 4 , wherein the compressed malware sample is a Macintosh Mach-O file.
15. A malware analysis system, comprising:
a hardware platform;
a guest infrastructure to run on the hardware platform;
a first guest to operate on the guest infrastructure and provide a sandbox, the sandbox including instructions to receive a compressed object file, extract the compressed object file into guest memory, and dump the guest memory to a binary image; and
a second guest to operate on the guest infrastructure and provide an analyzer, the analyzer including instructions to visually analyze the binary image according to an artificial intelligence subroutine, and determine whether the compressed object file is a malicious file.
16. The malware analysis system of claim 15 , wherein the sandbox is a virtual machine.
17. The malware analysis system of claim 16 , wherein the virtual machine is a Windows virtual machine.
18. The malware analysis system of claim 17 , wherein the guest infrastructure provides containerization.
19. The malware analysis system of claim 15 , wherein the sandbox includes a virtual machine and the analyzer includes a container.