DHS wants to predict how malware will morph

The Department of Homeland Security (DHS) wants to be able to predict what form malware will morph to so it can plan how to block it when it becomes reality.

DHS has granted Charles River Analytics in Cambridge, Mass., $500,000 to develop the technology, known as Predictive Malware Defense (PMD).

Charles River will use machine learning and statistical models to predict attacks based on new malware as well as create defenses ahead of time. The models will look at features of families of malware and predict how they might evolve.

Once it’s developed, PMD will be turned over to admins in private and public organizations – particularly financial organizations – so they can anticipate attacks before they happen, DHS says.

The project is part of a program called Internet Measurement and Attack Modeling that is also trying to create more resilient systems and networks, measure and map networks and model Internet-borne attacks.

+ ALSO ON NETWORK WORLD DHS moves to bolster intrusion/detection for federal networks +

A key element of IMAM is for DHS to understand how ISPs connect to each other and to map the peering relationships among them. That in turn will help identify what the important infrastructure elements are so they can be better protected, according to the DHS explanation of the effort.

The mapping will build on earlier efforts in the same area, DHS says, with the goal of being able to tap real-time data about internet traffic.

The attack modeling is to enable the owners of critical infrastructure to predict what the effects would be if those assets suffered successful cyberattacks, primarily by botnets and malware. It would also focus on figuring out the source of attacks.

That would be used to emulate the effects of botnets and worms across the entire internet to better understand how they spread and react to outside influences. This would help spot internet-scale emulation of observable malware, specifically botnets and worms to help identify weaknesses in the malware code and how it spreads or reacts to outside stimuli.

The effort would also try to figure out how best to remediate infected systems.