Chapter 9: Technical Threat Analysis – Similarity Analysis

Every day, a growing number of new and variant malware families emerge across the globe. To reduce the amount of overhead it takes to analyze individual malware families and organize and identify clusters of malicious activity, security researchers often apply techniques for finding malware and infrastructure similarities by utilizing techniques that group similarities together. In this chapter, we will be focusing on malware relationship analysis, specifically to help identify malware intrusion sets that are used in threat campaigns and are being pitted against organizations every day.

Fundamentally, analyzing the similarity between malware and its malicious infrastructure turns seemingly disparate datasets into valuable threat intelligence. This similarity analysis can be done in a litany of different ways, with many options developed to assist organizations. Still residing in the third phase of the intelligence...