I am Kon Kim and CEO of SRE it's a huge
honor to be in front of all of you I
would first like to thank Michael and
Janet and the executive of CTA thank you
so much for having me here what I'm
going to tell you about today is a
technology called DVP it's about
objective facts that must be accompanied
and explanations based on those facts we
use this a lot when working on Cyber 3
intelligence world we have automated
this technology to a certain level and
developed it to greatly assist in
related works and I'm here to share this
experience with you because I believe
this would eventually lead to a
development of technology that would
ensure the vuture development of our
community let me tell you briefly about
our company and
first SRE is a cyber 3 intelligence
company located in South Korea it's been
19 years since I founded this company
and it has also been listed on the
castal market uh we are now providing a
public intelligence service called
bos.com and of course we are a member of
CTA I major I majored in computer
science at y University uh after that I
found the srab and I am very interested
in b b analysis and CTI technology
development H who will be presenting
after my introduction is conducting
research on the application of AI models
in the cyber security field Chang Yun
Kim is conducting research on B
detection using artificial intelligence
at K R&D team in
Korea um now let's get to the point CTI
specialized companies especially when a
cyber 3 occurs begin the analysis by
trying to understand the background like
who is the attacker how did they attack
why are they attacking after all the
thre F have occurred the attacker and
attack techniques are anal analyzed and
will be provided in the form of a report
however this report must be written
clearly and based on object fact
analysis should not be based on the
personal opinions of the particular
analyst so we develop the core
technology to figure out how to automate
these objective
effects we next present deta details
about the
technology thank you Mr Kim I'm Hong Le
from Sans lab I'm really excited to
introduce our research uh the order of
today's presentation is as follows first
I will explain the background and then
we will explain the detailed technology
and some
examples starting with the specific
reason why I began researching this
technology I'll provide an explan
explanation of
DVP there are four key reasons why I
start this research firstly the
limitation of manual analysis secondly
high level requirement for analysis
thirdly the issue of repetitive same
threats and finally the subjectivity of
analysis let me tell you more in
details the first reason is the
limitation of manual analysis according
to AV Tas data new threats continue to
be made every month the number of
threats in February of this year was
about 2 2 million which is an average of
approximately 990,000 threats per
day due to a limited number of uh
analysts a lot of new emerging strats
cannot be manually analyzed clearly a
new approach is needed for covering all
these
threats the second reason is uh high
level requirement for analysis due to
many techniques required to analyze
threat in elligence this analysis can
only be performed by a small number of
high Lev cyber Security
Experts the third reason is the
repetition of same threats according to
virus total statistics a significant
percentage of the requested data is
already known this means that the same
types of threats are repeated over and
over
again if the same malware analysis is
repeated the nysis turn work turns into
a simple labor task in other words
fatigue increases and efficiency
decreases we need a way to identify new
highly engineered threats among numerous
similar
threats the final reason is the
subjectivity of analysis the result of
threat profiling are often said to be
determined by analy empirical knowhow
therefore for depending on their skills
and experience the result May differ
even for the same
threats so we created a technology
called DBP which means deep binary
profiler its purpose is to automatically
analyze the large quantities of threats
and generate objective TI
information so what role can DBP play
below is the repes representation of DB
dbp's technical tree fundamentally DBP
separate malicious code into several
several functions afterward it discover
whether the a function has been reused
from past
threats by identifying function reuse it
becomes easier to trace the usage
history of the function this extend the
functionality of DVP allowing it to
perform additional
tasks for instance inheriting the label
information from past analysis result
measuring the degree of
variation and distinguishing between new
functions and
variants to make this old task possible
the similarity between two assembly code
must be
measurable however calculating
similarity requires a numerical vectors
not just text Data like assembly
codes
let's take RGB colors as an example when
working with the color data on your
computer we express the color
combination with three
dimensions red green and blue since this
is a numerical Vector the similarity can
be calculated as you can see on the
screen like this color data we need a
vector representation methods uh for
assembly codes to compute the similarity
between them to obtain the numerical
vectors of these codes we trained an AI
embeding
model this model understand the meaning
of assembly codes and convert it into
appropriate numerical
vectors I'll not go into detail about
the AI part here if you have any
questions about it uh feel please feel
free to talk with me
individually the key you should know
that is two functions with similar code
are converted into two similar
vectors by calculating similarity
between these two vectors it is possible
to distinguish whether the two functions
are the same or different as a result we
can determine whether it has been reused
or not with the function database which
contain function data of the past
threats for example let's say there is a
malware that consist of five assembly
functions after searching the function
from database the usage history of
function is
tracked if the same function has been
used in the past the previous analysis
result can be utilized as a reference
the label information from past analysis
results such as
t127 Ledger thread actor or encryption
function of ransomware can be applied
because it's the same
function the dppp analysis results as
shown in the picture it's largely
divided into two parts the first part on
the left is the analysis result for each
functions it includes the name of
functions identified labels and hash
information for files using the same
function the second part is a summary
information that aggregate the analysis
Resort for each function
it provides how many functions belong
based on label information such as
threat actor threat category and
technique
ID this part is a case study for how DBP
can be applied from here my coworker
Chang Kim will continue the
presentation thank
you thank you Hong for nice explanation
about the dppp from now on I would like
to discuss how DBP could be applied in
Practical
scenarios we conducted an analysis of
2150 data collected on December 19th
2022 when we see the left side of graph
the red part 888 of them are classified
as
mishes our analysis focused on these
malicious data employing
DBP when we see the right side
Approximately 80% 699 were identified as
variant threats and 20% eight 189 were
new threats in here when we are seeing
variant thre that means the thre that
can be correlated in our thre database
new thre are the opposite
cases through dppp analysis of 699 Baran
thre we are able to identify the most
commonly used three categories tis and
three
dector the blue graph represent the
three categories the green graph
represent tids and the red graph
represent the three
actors going further we could also analy
ize reciprocal
relationships please look at this pie
chart based on the DVP result you can
determine which three dector is carrying
out the attack with which three
categories and which ts are
used let's take a closer look with a
more specific
example in our database we have stored
functions used in the past by the Lazar
groups
this by verifying new thre reusing of
these functions we can analyze whether
the
function have been partially modified or
if it is using the exact exact same
functions through this capability we are
able to trace the disable mod
used in the 2014 Sony Pictures attack
within the collected
data starting from the discovered this
mware as a starting point we check the
Reus relationships of malicious code
functions that exhibited more than 40%
variation from the base
file as a result of this
tracking we are able to identify 37
similar
threats so we drew a graph about this
307
thre the nodes are indicating the 37
thre and the number on the edge indicat
the ratio of function
reuse when categorized based on the
identified three
vectors we observe the separation into
three distinct
clusters the cluster one is a Lazar
group showing the
red the cluster
two is the at AP1 17 group showing
orange the cluster three positions
between cluster one and cluster two is
another smaller AP1 17
group Mark in Orange as
well you can see that that cluster three
are reusing functions from other two
clusters which group originally
implemented these
functions let's arrange the noes in this
graph based on first scen date and
number of
functions here are the arranging
result analyzing the graph we can see
that in
2022 another new AP 17s attack emerged
by reusing functions from AP1 17 and the
reses
group DBP can provide digital evidence
as
well these assembly codes serves as
digital evidence for function
reuse the functions you can see here are
used in cluster one and cluster
three
as you can see in the assembly code even
though the screen is pretty
small there using the same
function by analyzing the usage history
of the function on the
left it becomes evident that it is a
function frequently employed by the
Lazar
group these functions are used in
cluster two and cluster three
when you see in the assembly code as
well the same functions was
used looking at the graph on the
left we can see a history of the uses by
the
ap17 Lazarus and Petri
groups however it is evident that this
functions are overwhelmingly used by the
AP
17 additionally this function is is
associated with the
t182 but when we check the users history
of this function there is no information
about the third
actor this indicates that it is a
function which the third actor has not
been founded by
DBP we will not proceed to summarize the
DVP
research
there were a total four problems and we
able to alleviate these problems with
DBP first of all limitation of manual
analysis with DBP we can automatically
analyze three intelligence and
significantly reducing analysis
time next demands of high level
analysis
requirements
okay start
again next
advertisement we are using mapbook as
well DBP can utilize information from
past analysis of the same functions to
provide precise
Direction third repetition of barri and
thre normally when we try to collect
data more than 60% were variant
threads D can distinguish whether a thre
file is newer
variant helping to pinpoint the starting
point for
analysis finally there is a subjectivity
of
analysis depends on the expert personal
experience the analysis result could be
different through
DBP it is possible to to provide
objective evidence for analysis result
in assembly
code thank you Mr Kim will conclude the
presentation thank you to our two
researchers for their hard work our
technology which we introduced is not a
technology that replaces existing
Technologies but but is designed to be
used together with existing technology
to access the root cause of attacks and
to share objective facts to enable more
effective
responses of course you will be able to
explain not only the attack but also who
did the attack and what attack
techniques was
used back data and automated
Technologies based on objective fact
which we looked at earlier at eliminate
redundant analysis issues from various
communities activ active in the Cyber 3
intelligence
World in other words it reduces the
complexity because even a single attack
can be interpreted in various ways cyber
threats are continuously increasing in
addition it will become more advanced
and faster with generative AI
technology however human resources and
analyst capabilities have physical
limitation like our technology the
underlying technology that will be used
for intelligence will maximize the
efficiency of the human resource itself
and increase its ability to respond per
unit of
time I think that this is the true
Community effect that we said that we
said we are
pursuing
thank you for listening we will have a
short Q&A session from now
on