Locating executable fragments with concordia, a scalable, semantics-based architecture

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

The amount of digital evidence that must be processed by forensic tools and analysts is growing rapidly. This makes automated analysis a critical activity; an activity where con- tinuous improvement is crucial. Concordia is a platform for investigating code semantics. One of Concordia's functions is identification of unknown code fragments; attempting to elucidate the possible objectives and origination of this type of evidence is our ultimate goal. Here we provide a synopsis of a method that identifies and locates code fragments using n-gram and semantics-based features and a k nearest neigh- bors classifier. Our objective is to identify a set of candidate files that may contain the unknown and supply additional details to isolate it within this set. To accomplish this task, Concordia uses the MapReduce model to process a large set of invariants to provide forensic experts a more efficient and automated way to produce solid intelligence about a growing body of evidence.

Original languageEnglish
Title of host publication8th Annual Cyber Security and Information Intelligence Research Workshop
Subtitle of host publicationFederal Cyber Security R and D Program Thrusts, CSIIRW 2013
DOIs
StatePublished - 2013
Event8th Annual Cyber Security and Information Intelligence Research Workshop: Federal Cyber Security R and D Program Thrusts, CSIIRW 2013 - Oak Ridge, TN, United States
Duration: Jan 8 2013Jan 10 2013

Publication series

NameACM International Conference Proceeding Series

Conference

Conference8th Annual Cyber Security and Information Intelligence Research Workshop: Federal Cyber Security R and D Program Thrusts, CSIIRW 2013
Country/TerritoryUnited States
CityOak Ridge, TN
Period01/8/1301/10/13

Fingerprint

Dive into the research topics of 'Locating executable fragments with concordia, a scalable, semantics-based architecture'. Together they form a unique fingerprint.

Cite this