Using Math to Speed Up Security Assessments of Windows Executables
summary
Claims a triage tool that extracts ~20 static metadata fields from PE files, applies Euclidean distance on logged metadata to find nearest-peer binaries, and uses Bayesian backfill when metadata is sparse to predict capabilities like networking. Implemented as a CLI prototype (Python → Go), it surfaces surprising signals—one file shows a 38% Bayesian probability of networking and later reveals ~30 networking functions—and routinely reduces triage from days to seconds, enabling a 2.5-hour assessment that otherwise would take about a week.
AI-written summary · about
chapters (5)
related talks
44mNetsec is Dead(?): Modern Network Fingerprinting for...
40mMalware Reverse Engineering with PE Tree—OSS Inspired by COVID
33mCommSec D1 - Faster, Wider, Greater: Modern Pentest Tricks
50mVerify your software for security bugs
28mBeyond AV: Detection-Oriented File Analysis
23mSecurity Outgunned: Measuring Software Defined Attack Surface
48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
47mPrevalent Characteristics in Modern Malware