知识辅助的可视化恶意软件分析系统：KAMAS的设计、验证与反思
A Knowledge-Assisted Visual Malware Analysis System: Design, Validation, and Reflection of KAMAS
摘要：
IT安全专家从事基于行为的恶意软件分析，以了解以前未知的恶意软件（恶意软件）或恶意软件家族样本。为此，他们需要从大量的执行跟踪中找到可疑模式并对其进行分类。目前可用的系统不满足分析师的需求描述为：视觉访问适合于复杂的数据结构，适合IT安全专家的视觉表示，提供工作流特定的交互技术，并能够外部化的规则的形式，以便于分析和与同事共享的知识。为了缩小这一差距，我们设计并开发了KAMAS，这是一个用于基于行为的恶意软件分析的知识辅助可视化系统。KAMAS支持恶意软件分析师使用可视化分析和分析过程的知识外部化方法。手头的文件是一个设计研究，描述了原型的设计，实施和评估。我们报告的验证KAMAS的专家评论，用户研究领域的专家，和焦点小组会议与行业分析师。此外，我们反映了设计研究所获得的见解，并讨论了应用可视化方法的优点和缺点。
英文摘要：
IT-security experts engage in behavior-based malware analysis in order to learn about previously unknown samples of malicious software (malware) or malware families. For this, they need to find and categorize suspicious patterns from large collections of execution traces. Currently available systems do not meet the analysts' needs described as: visual access suitable for complex data structures, visual representations appropriate for IT-security experts, provide work flow-specific interaction techniques, and the ability to externalize knowledge in the form of rules to ease analysis and for sharing with colleagues. To close this gap, we designed and developed KAMAS, a knowledge-assisted visualization system for behavior-based malware analysis. KAMAS supports malware analysts with visual analytics and knowledge externalization methods for the analysis process. The paper at hand is a design study that describes the design, implementation, and evaluation of the prototype. We report on the validation of KAMAS by expert reviews, a user study with domain experts, and focus group meetings with analysts from industry. Additionally, we reflect the gained insights of the design study and discuss the advantages and disadvantages of the applied visualization methods.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
