Sukriti Bhattacharya Email & Phone Number

Esch-Sur-Alzette, Lu

Luxembourg

London, United Kingdom

Project #1: Compositional Security Analysis for Binaries (EP/K032038/1):Description:We introduced a scalable approach to malware similarity detection based on information theory. Information-theoretic similarity measures identify patterns at a high level of abstraction and difficult to counter by an adversary working at the assembly/source code level. This has the potential to be a strong move in the malware arms race, inhibiting the current ease of malware production.Tool Designed(Ruby / Linux): SLaMM (Statistical Language Model for Malware binaries), a novel malware classifier that is linear and precision-optimised, two traits essential for the target use case, the detection of desktop malware. SLaMM is composed of three sub-classifiers; It builds n-gram language models over zoos of malware and benign-ware. It then uses three different information theoretic metrics, Cross Entropy, Kullback-Liebler Divergence, and Mean Square Error to compare a candidate file with these models. SLaMM exhibits a very good accuracy (88%) with sufficiently low false positive rate (0.027).Project #2: SeMaMatch (Semantic Malware Matching, EP/K032623/1)Description:Malware writers with the aid of code transformation techniques are able to produce several new instances of malicious software, which are undetectable by most current detection methods. Therefore, major improvements in current malware detection techniques are required to tackle new transformed variants of malware. In this experiment, we tried to detect malware variants (possibly obfuscated) using a semantics-based approach, capturing semantic properties from a program traces and to detect different malware variants using those properties.Tool Designed(C++ / Linux): We designed our own binary instrumentation tools using Intel Pin DBI framework that efficiently extracts semantic properties from program traces.

Bordeaux, Nouvelle-Aquitaine, France

Funchal, Madeira, Portugal

Project: AEMINIUM (CMU-PT/SE/0038/2008)Description: I investigated on the use of a formal methods tool for checking security properties of Tokeneer, a U.S. National Security Agency (NSA) project developed by Praxis, and released in 2008.Tool Designed (Event-B, Java / Windows): The Rodin toolset is used for modeling Tokeneer in Event-B and for discharging associated proof obligations, the EventB2Java is used to generate Java code for the Event-B model of Tokeneer. Then, a series of JUnit tests were written to validate if the Java implementation of Tokeneer adhered to some security properties of Tokeneer that are described in the documentation provided by Praxis.