TitleA Knowledge-Assisted Visual Malware Analysis System: Design, Validation, and Reflection of KAMAS
Publication TypeJournal Article
Year of Publication2017
AuthorsWagner, M., A. Rind, N. Thür, and W. Aigner
JournalComputers & Security
Volume67
Pages1-15
Date Published02/2017
ISSN0167-4048
Keywordsbehavior-based, Design Study, interactive, knowledge generation, malicious software, malware analysis, prototype, Visual analytics, Visualization
AbstractIT-security experts engage in behavior-based malware analysis in order to learn about previously unknown samples of malicious software (malware) or malware families. For this, they need to find and categorize suspicious patterns from large collections of execution traces. Currently available systems do not meet the analysts' needs described as: visual access suitable for complex data structures, visual representations appropriate for IT-security experts, provide work ow-specific interaction techniques, and the ability to externalize knowledge in the form of rules to ease analysis and for sharing with colleagues. To close this gap, we designed and developed KAMAS, a knowledge-assisted visualization system for behavior-based malware analysis. KAMAS supports malware analysts with visual analytics and knowledge externalization methods for the analysis process. The paper at hand is a design study that describes the design, implementation, and evaluation of the prototype. We report on the validation of KAMAS by expert reviews, a user study with domain experts, and focus group meetings with analysts from industry. Additionally, we reflect the gained insights of the design study and discuss the advantages and disadvantages of the applied visualization methods.
URLhttp://mc.fhstp.ac.at/sites/default/files/publications/Wagner_et_al_KAMAS.pdf
DOI10.1016/j.cose.2017.02.003
Short TitleA knowledge-assisted visual malware analysis system
Refereed DesignationRefereed