Using Math to Speed Up Security Assessments of Windows Executables

Cole Thompson - Using Ancient Math to Speed Up Security Assessments of Windows Executables This is about greatly speeding up risk reduction when evaluating Windows programs. Reverse engineering binary programs tends to go one of two ways: either a q...

Cole Thompson - Using Ancient Math to Speed Up Security Assessments of Windows Executables

This is about greatly speeding up risk reduction when evaluating Windows programs. Reverse engineering binary programs tends to go one of two ways: either a quick static analysis using utilities like "strings", or a time consuming dive down the rabbit hole monitoring API calls or debugging with tools like IDA Pro. The payoff from reverse engineering can be great, *if* one picks the right targets. Over several years performing assessments in a highly regulated environment, often under pressure, it became imperative to quickly triage Windows programs to decide which are worth the effort.

I found no tool to do this triage, so I gradually developed one. Eventually I settled on applying the math of Euclidean Distance and Bayes Theorem to static metadata taken from Windows executables. This can identify within seconds which executable (out of dozens or hundreds) to focus on. That triage used to take hours or days. I will demonstrate the tool, give a couple of success stories (anonymized by necessity) and explain the learnings from its evolution. The underlying approach can be applied by individuals with slim resources to many areas of security analysis.