A knowledge-assisted visual malware analysis system: Design, validation, and reflection of KAMAS. Issue 67 (June 2017)

• Record Type: Journal Article
• Authors: Wagner, Markus; Rind, Alexander; Thür, Niklas; Aigner, Wolfgang
• Is Part Of: Computers & security. Issue 67(2017)
• Page Start: 1
• Page End: 15
• Publication Date: 2017-06
• Subjects: Malicious software -- Malware analysis -- Behavior-based -- Design study -- Prototype -- Visualization -- Visual analytics -- Interactive -- Knowledge generation; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2017.02.003
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: IT-security experts engage in behavior-based malware analysis in order to learn about previously unknown samples of malicious software (malware) or malware families. For this, they need to find and categorize suspicious patterns from large collections of execution traces. Currently available systems do not meet the analysts' needs which are described as: visual access suitable for complex data structures, visual representations appropriate for IT-security experts, provision of workflow-specific interaction techniques, and the ability to externalize knowledge in the form of rules to ease the analysis process and to share with colleagues. To close this gap, we designed and developed KAMAS, a knowledge-assisted visualization system for behavior-based malware analysis. This paper is a design study that describes the design, implementation, and evaluation of the prototype. We report on the validation of KAMAS with expert reviews, a user study with domain experts and focus group meetings with analysts from industry. Additionally, we reflect on the acquired insights of the design study and discuss the advantages and disadvantages of the applied visualization methods. An interesting finding is that the arc-diagram was one of the preferred visualization techniques during the design phase but did not provide the expected benefits for finding patterns. In contrast, the seemingly simple looking connection line was described as supportive in finding the link between the rule overview table and the rule detail table which are playing a central role for the analysis in KAMAS.