Catch me if you can: Building a Web Malware Analyzer using Machine Learning
summary
Cloudflare builds a Docker-based tarpit that spins up hundreds of thousands of CMS instances, feeds dropped files into a cuckoo-based sandbox, and labels payloads using static+dynamic features and machine learning (favoring random forests and tree ensembles). The system catches obfuscated PHP/JavaScript and malicious ad redirections, ships screenshots and sandbox traces, and reduces false positives via human-reviewed retraining. Operational limits include IP rotation, VM-detection by malware, CPU cost of large-scale analysis, and the need for continuous retraining.
AI-written summary · about
chapters (15)
- 0:00Intro
- 2:01Stop The Hacker - CloudFlare
- 4:24Web Malware - Existing Tools Fail
- 6:35Web Malware - Attack Vectors
- 7:47Identification - Highlights
- 9:38Identification - Challenges
- 14:03Identification - Web Malware
- 21:57Tarpit - Collect Data
- 23:58Tarpit - Is this better
- 26:21Tarpit - Startup
- 28:45Tarpit - Challenges
- 30:10Tarpit - A Twist
- 31:36Machine Learning
- 44:03More Challenges
- 46:51That's all folks
related talks
18mMac-A-Mal: An Automated Platform for Mac Malware Hunting
26mWhen Models Write Malware: Defending Against On-demand Exploits
21mAutomating dynamic malware analysis
27mA Machine Learning approach for detecting a Malware
33mBasic Malware Analysis for Incident Responders
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
46mLiving off the Cloud: A Server-Free Approach to Malware Ops
47mWorm Charming: Harvesting Malware Lures for Fun and Profit