Improving Attribution & Malware Identification With Machine Learning

One of the cybersecurity promises of machine learning (particularly "deep learning") is that it can accurately identify malware nobody has ever seen before because of what it's learned about malware it's seen in the past. Konstantin Berlin, senior research engineer at Invincea Labs, is trying to take the techology further, so that organizations can get more information about unfamiliar code than simply "it's benign" or "it's malicious." Berlin, who will be presenting his work next month at Black Hat, says security pros also want to know more about the malware family so they can plan their mitigation strategy accordingly. His technique, he says will do that, as well as improve malware triage and attribution by using new methods of recognizing similarities between malware samples. This can all be done in a customized way that enables each organization to choose what features and factors interest them most.