Cloud-based Autonomous Real-time Malware Analysis (CARMA)

The amount of new malware encountered daily is accelerating at an unprecedented rate, an explosion that is also reflected in target and attack vector diversity. There has also been a dramatic increase in the use of malware kits, a problem in its own right because kits allow adversaries to easily create one-time-use malware variants for which generic signatures and general solutions are neither practical nor effective. We propose to demonstrate a heterogeneous cloud-based defense system that detects novel malware and provides critical functionality in the areas of real-time analysis, scalability, accuracy, and systemic coverage and knowledge distribution. Under our Cloud-Based Autonomous Real-Time Malware Analysis (CARMA) effort, we will study how to use cloud resources to perform deep malware analyses that will address two critical questions. To address the"Is it a variant of existing malware?"question, we will use ideas from genetics and evolutionary biology to perform evolutionary analysis of malware to determine the inheritance relationships among parts of malware across samples. To address the"What does it do?"question, we will use ideas from functional linguistics to identify and characterize the functions of the malware and its constituent parts.