SecureWoof is an AI-powered malware scanner that provides users with an efficient and reliable method to detect and analyze potentially harmful executable files.
To achieve this, the tool utilizes various techniques and open source libraries. When a user uploads an executable file, SecureWoof performs a series of steps to assess its security.
First, the file is scanned against a set of static Yara rules, which helps identify any known patterns or signatures associated with malicious code. Next, the file is unpacked using the Retdec unpacker, a widely used tool for decompressing files.
After unpacking, the file is decompiled into a single C file using Ghidra, an open source software package. This process allows the tool to analyze the code and understand its structure.
Next, the decompiled code is formatted using clang-tidy, a tool for ensuring code quality and compliance with coding standards. To further enhance analysis, the decompiled code is embedded using FastText, a library that enables the tool to understand the semantic context of the code.
Finally, the file undergoes a maliciousness assessment using a trained RoBERTa transformer network. The RoBERTa and FastText models used by SecureWoof were trained using the SOREL-20M malware dataset, enhancing their ability to accurately identify and classify potential threats within uploaded files.
With its intelligent scanning capabilities, SecureWoof offers users an advanced solution to proactively address cybersecurity risks associated with executable files.
