|
|
Extraction of Static Features from Binary Applications for Malware Analysis
Pružinec, Jakub ; Hanáček, Petr (referee) ; Kolář, Dušan (advisor)
Podoby škodlivého software sa deň čo deň menia a vyvíjajú. Vzniká tak nutnosť jednostaj tvoriť, aktualizovať a zlepšovať metódy na analýzu škodlivého software. Jedným z možných prístupov ako bojovať proti škodlivému software je klasifikovať ho na základe určitých statických charakteristík. Táto práca sa zaoberá návrhom a extrakciou týchto čŕt z binárnych spustiteľných súborov. Cieľom tejto práce je obohatiť nástroj na extrakciu statických rysov o extrakciu nových rysov a overenie ich účinnosti pri klasifikácii škodlivého software. Nástroj je vyvíjaný v spolupráci so spoločnosťou Avast, kde sa používa v systéme zhlukovej analýze.
|
|
|
Application of Unsupervised Learning Methods in Graph Similarity Search
Sabo, Jozef ; Burgetová, Ivana (referee) ; Křivka, Zbyněk (advisor)
Goal of this master's thesis was in cooperation with the company Avast to design a system, which can extract knowledge from a database of graphs. Graphs, used for data mining, describe behaviour of computer systems and they are anonymously inserted into the company's database from systems of the company's products users. Each graph in the database can be assigned with one of two labels: clean or malware (malicious) graph. The task of the proposed self-learning system is to find clusters of graphs in the graph database, in which the classes of graphs do not mix. Graph clusters with only one class of graphs can be interpreted as different types of clean or malware graphs and they are a useful source of further analysis on the graphs. To evaluate the quality of the clusters, a custom metric, named as monochromaticity, was designed. The metric evaluates the quality of the clusters based on how much clean and malware graphs are mixed in the clusters. The best results of the metric were obtained when vector representations of graphs were created by a deep learning model (variational graph autoencoder with two relation graph convolution operators) and the parameterless method MeanShift was used for clustering over vectors.
|
|
|
Incremental Parsing for YARA Language
Dvořák, Vojtěch ; Kolář, Dušan (referee) ; Regéciová, Dominika (advisor)
The main goal of this bachelor thesis is to design and implement a program library that enables incremental static analysis of the YARA language. One of the main purposes of this new library is to integrate with the open-source Yara Language Server project developed by Avast. Compared to the existing solution, which uses a non-incremental approach to analysis, the machine time requirements should be reduced. In addition to information about the software solution, this thesis also includes a summary of the theory focusing on static analysis and its incremental variant, essential information about the YARA tool, and an introduction to the existing solution, the Yaramod-v3 library. The thesis also contains a comparison of the new library with the current solution, in which the achieved results are presented. The experiments performed showed that the new library is able to perform incremental analysis of a modified rule set approximately 20× – 2000× faster depending on the particular set.
|
|
| |
|
|
Application of Unsupervised Learning Methods in Graph Similarity Search
Sabo, Jozef ; Burgetová, Ivana (referee) ; Křivka, Zbyněk (advisor)
Goal of this master's thesis was in cooperation with the company Avast to design a system, which can extract knowledge from a database of graphs. Graphs, used for data mining, describe behaviour of computer systems and they are anonymously inserted into the company's database from systems of the company's products users. Each graph in the database can be assigned with one of two labels: clean or malware (malicious) graph. The task of the proposed self-learning system is to find clusters of graphs in the graph database, in which the classes of graphs do not mix. Graph clusters with only one class of graphs can be interpreted as different types of clean or malware graphs and they are a useful source of further analysis on the graphs. To evaluate the quality of the clusters, a custom metric, named as monochromaticity, was designed. The metric evaluates the quality of the clusters based on how much clean and malware graphs are mixed in the clusters. The best results of the metric were obtained when vector representations of graphs were created by a deep learning model (variational graph autoencoder with two relation graph convolution operators) and the parameterless method MeanShift was used for clustering over vectors.
|
|
|
Extraction of Static Features from Binary Applications for Malware Analysis
Pružinec, Jakub ; Hanáček, Petr (referee) ; Kolář, Dušan (advisor)
Podoby škodlivého software sa deň čo deň menia a vyvíjajú. Vzniká tak nutnosť jednostaj tvoriť, aktualizovať a zlepšovať metódy na analýzu škodlivého software. Jedným z možných prístupov ako bojovať proti škodlivému software je klasifikovať ho na základe určitých statických charakteristík. Táto práca sa zaoberá návrhom a extrakciou týchto čŕt z binárnych spustiteľných súborov. Cieľom tejto práce je obohatiť nástroj na extrakciu statických rysov o extrakciu nových rysov a overenie ich účinnosti pri klasifikácii škodlivého software. Nástroj je vyvíjaný v spolupráci so spoločnosťou Avast, kde sa používa v systéme zhlukovej analýze.
|
|
|
Choosing an antivirus program
David, Jan ; Pícka, Marek (advisor) ; Hanzlík, Petr (referee)
This bachelor thesis is focused on choosing a free antivirus software for basic internet usage on a personal computer.
The first part focuses on the issue of malicious software and is divided into categories based on various viewpoints. In addition, several types of prevention are mentioned. This part also explains the history of antivirus software.
The second part contains the actual comparison of five freeware antiviruses. Selection of these five programs is based on a survey. The test consists of five criteria: time of computer deep scan, disc usage, memory usage, user interface and safety rating by AV-Test. These criteria are weighted using Saaty method and the final result is calculated using a weighted sum method.
|
|
|
Position of a given company on Czech and world market - marketing perspective
Nováková, Jana ; Filipová, Alena (advisor) ; Brábník, Miroslav (referee)
The bachelor thesis is supposed to evaluate the position of AVAST company on Czech and world market from marketing perspective. First section describes basic theoretical marketing tools such as life cycle, competition analysis, marketing strategies etc. Second section approaches historical evolution of information technology and antivirus software. Specifically applied third section focuses on the development of AVAST company and then examines its competitive position on Czech and world market. Conclusion evaluates facts obtained from applied section and finds crucial marketing strategies, which lead AVAST to leading position on Czech and world antivirus market.
|
|
|
A/B Testing and its use for Conversion Rate Optimization
Makoš, Michal ; Stříteský, Václav (advisor) ; Pešek, Ondřej (referee)
The main topic of this bachelor thesis is a conversion rate optimization and A/B testing. The theoretical part covers both topics and proposes possible steps to follow when using them. The thesis also describes the tools which are needed for successful conversion rate optimization. The aim of the practical part is to identify the impact of individual elements on conversion rate and find those with positive impact. At the same time, the thesis aspires to formulate recommendations for increasing conversion rate and business performance. The research was conducted by undertaking A/B tests and its analysis.
|
|
|
Effective A/B and Multivariate Testing in the Global Market Environment
Janů, Tomáš ; Gála, Libor (advisor) ; Seman, Vladimír (referee)
Thesis is focused on online content testing for the purpose of optimizing the performance of business and information channels in a global environment, i.e. where visitors come from different countries. This diversity causes different behavior of visitors, for example as the American perception of the content is entirely different from the Brazilian and French. Different perceptions and consumer behavior is caused by a different national culture in these countries. Therefore it is necessary or appropriate to test content for the purpose of optimizing on the local level. The simplest option is obviously to run the same test for each country separately. But that is extremely difficult in practice because of the duration of the test and human resources needed for test design, implementation, and evaluation. Therefore the aim of this thesis is to suggest modification of the general method used for testing the online content that will be sufficient for testing on the local level and will take cultural differences of each country into account, but yet also will be effective in terms of time and human resources consumption. Currently there isn't any publicly documented method which would cover this issue. The key of this modification is the segmentation of countries into groups based on similar national culture. Therefore the value of national culture has to be identified in some way and for this purpose it is possible to use model of the Dutch Professor Geert Hofstede, who identified six dimensions of national culture for each country and assigned them values. The benefit of this thesis is described modification of the testing method which is particularly suitable for companies operating on the global market or multiple markets simultaneously. This method, if it's used properly, is able to deliver growth of revenue while simultaneously reducing the consumption of human resources.
|
guest ::
