[Barret]

Im currently developing an analyzer that can make an assessment of an assembly that is or is not potentially a trojan or virus using a neural network,
It is still in very alpha/test state but the result are quit interesting.
The more samples the better, however the more you get the longer it takes for a network to sample them into a fully working network, it is and can be very time consuming.

Scores or so called footprints are made out of data that consists from targeted information that is commonly used in malware, trojans or rats,
however the downside is that false-positives is also highly possible.

Currently implemented scanners:
- PInvoke Call Ratio
- String (WMI Query)
- Registry (Run, RunOnce)
- References (Sockets, Diagnostics)

Now these values individually don't or can't predict a good assessment if an assembly is bad or good but combined it can create a bigger picture in a certain context.


Some trial screenshots:

Training with samples


Network prediction of a real rat


Network prediction of a clean assembly (ILSpy.exe)



Let me know what your idea or suggestion is and samples are welcome (very much!!!).

-B

[VmX5]

Holy crap, I've been hoping that you would do more AI stuff. I saw your stuff with fingerprint recognition and I was really interested. I recently started learning about Neural networks, machine learning, and just AI as a whole. Anyways great project I'd love to see more of this project and other AI projects in the future. Amazing work.

[Barret]

Holy crap, I've been hoping that you would do more AI stuff. I saw your stuff with fingerprint recognition and I was really interested. I recently started learning about Neural networks, machine learning, and just AI as a whole. Anyways great project I'd love to see more of this project and other AI projects in the future. Amazing work.

Still lots of work to do tho hehe, but im looking for samples :P to feed the machine

[Vyxn]

Is TheBarret also you? I read his Neural Network and fuck, its awesome! This will also be an awesome implementation of it.
I'll wait for the release as I'm also interested about the analysis thing. Good work OP!

[Ninja]

This is very interesting. Which type of neural network did you go with? I had tinkered around in the past with the NEAT algorithm to learn a program to play a game of tic-tac-toe. I've always wanted to go with different algorithms as I heard NEAT wasn't very suited for speech recognition which is something I wanted to get more into.

[Adderall]

Looks very cool. I have a suggestion for you for a new scanner for indicating malware if you did not already have it in mind. Some malware also uses the Task Scheduler instead of the Registry/Run. Most standard .exe programs usually won't use it, so it can be an indicator for some malicious programs. It is very interesting to see a program like this using neural networking, good luck.