,
10 tweets,
1 min read
Read on Twitter
it's always interesting to watch software engineering researchers approach malware analysis. while they have a quiver of powerful tools 1/x
their assumptions about software development often break down in the malware domain. those assumptions include a steady pool of 2/x
developers, only adding functionality, and the like. this ignores minor variants seen in malware development, copy-pasta and 3/x
cargo cult practices by many malware devs, etc. never mind the input data sets often used in these studies which itself lacks rigor. 4/x
as such while this inference algorithm is interesting, these caveats are crucial to understand. a more rigorous evaluation would be on 5/x
a corpus of crafted malware for which ground truth is known, which uses a steady pool of adversarial techniques to thwart analysis. 6/x
ran into this some years ago on a malware corpus reserch project, which built on my prior experience in the wild and inspured uses of 7/x
lineage and development progression analysis. i'm glad to see people continuing this work, but do know that studying malware brings 8/x
with it a lot of hidden pitfalls not obvious to new entrants, things learned by experience. 9/x
these factors must be accounted for and controlled if you're to do science. /end
