Malheur v0.4.7 - Automatic Analysis of Malware Behavior

Malheur allows for identifying novel classes of malware with similar behavior and assigning unknown malware to discovered classes.

Analysis of malware behavior?

Malheur builds on the concept of dynamic analysis: Malware binaries are collected in the wild and executed in a sandbox, where their behavior is monitored during run-time. The execution of each malware binary results in a report of recorded behavior. Malheur analyzes these reports for discovery and discrimination of malware classes using machine learning.

It supports four basic actions for analysis which can be applied to reports of recorded behavior:

• Extraction of prototypes: From a given set of reports, Malheur identifies a subset of prototypes representative for the full data set. The prototypes provide a quick overview of recorded behavior and can be used to guide manual inspection.
• Clustering of behavior: Malheur automatically identifies groups (clusters) of reports containing similar behavior. Clustering allows for discovering novel classes of malware and provides the basis for crafting specific detection and defense mechanisms, such as anti-virus signatures.
• Classification of behavior Based on a set of previously clustered reports, Malheur is able to assign unknown behavior to known groups of malware. Classification enables identifying novel variants of malware and can be used to filter program behavior prior to manual inspection.
• Incremental analysis: Malheur can be applied incrementally for analysis of large data sets. By processing reports in chunks, run-time and memory requirements are significantly reduced. This renders long-term application feasible, for example for daily analysis of incoming malware.

Dependencies

• >= uthash-1.7
• >= libconfig-1.3.2
• >= libarchive-2.70

• Read the Manual: HTML | PDF
• Read How To Install

More information: here