Titel (eng): A knowledge-assisted visual malware analysis system: Design, validation and reflection of KAMAS

Autor: Wagner, M. (Markus)
Rind, A. (Alexander)
Thür, N. (Niklas)
Aigner, W. (Wolfgang)

Beschreibung (eng): IT-security experts engage in behavior-based malware analysis in order to learn about previously unknown samples of malicious software (malware) or malware families. For this, they need to find and categorize suspicious patterns from large collections of execution traces.
Currently available systems do not meet the analysts' needs described as: visual access suitable for complex data structures, visual representations appropriate for IT-security experts, provide workflow-specific interaction techniques, and the ability to externalize knowledge in the form of rules to ease analysis and for sharing with colleagues.
To close this gap, we designed and developed KAMAS, a knowledge-assisted visualization system for behavior-based malware analysis. KAMAS supports malware analysts with visual analytics and knowledge externalization methods for the analysis process.
The paper at hand is a design study that describes the design, implementation, and evaluation of the prototype. We report on the validation of KAMAS by expert reviews, a user study with domain experts, and focus group meetings with analysts from industry. Additionally, we reflect the gained insights of the design study and discuss the advantages and disadvantages of the applied visualization methods.
It is very interesting that the arc-diagram was one of the preferred visualization techniques during the design phase but it did not provide the expected benefits for pattern finding. In contrast, the seemingly simple looking connection line was described as supportive finding the link between these tables.

The collection bundles supplement materials and research data for a journal article published in Computers & Security under doi:10.1016/j.cose.2017.02.003.

Sprache des Objekts: Englisch Deutsch

Datum: 2017

Klassifikation: malicious software; malware analysis; behavior-based; prototype; visualization; visual analytics; interactive; knowledge generation; design study

Mitglieder dieser Collection (10):
o:2979 Video Walkthrough of KAMAS
o:1263 A knowledge-assisted visual malware analysis system: Design, validation and reflection of KAMAS
o:1261 A knowledge-assisted visual malware analysis system: Design, validation and reflection of KAMAS
o:1260 Prototype of KAMAS with five different analysis clusters.
o:1259 Screenshot of KAMAS with a cluster of 15 malware samples
o:1258 Screenshot of KAMAS with a cluster of 12 malware samples
o:1257 Screenshot of KAMAS with a cluster of 10 malware samples
o:1256 Screenshot of KAMAS with a cluster of 17 malware samples
o:1255 Screenshot of KAMAS with a cluster of 16 malware samples
o:1254 Studiendesign und Interviewleitfaden der KAMAS User Study
Permanent Identifier