Unmasking Malware Families
Brief
Identifying malware families is hard. Malware samples are often packed, strings encrypted and configurations may only appear after several stages of execution. Even experienced reverse engineers can get the malware family wrong and commercial sandboxes do not always produce correct classifications.
Malware C2 network traffic can provide another way to approach the problem. C2 traffic often contains enough information to identify the application-layer protocol and the malware family using it.
FlowCarp
FlowCarp identifies application-layer protocols in network traffic by analyzing observable characteristics of the traffic. It computes statistical measurements from a capture and compares them with models for known protocols.
Unlike traditional IDS signatures, FlowCarp protocol models do not describe protocols using specific strings or byte sequences.