rieck / malheur Goto Github PK

Excuse me, i am currently doing a research about Malheur therefore i need to get the comparison of precision and recall of Malheur version 0.4.6 and newest (0.5.3). Currently the problem i am facing is libarchive-2.7.0.tar.gz from https://github.com/libarchive/libarchive/downloads and after tar that particular version and configure, "make" cannot be completed, with an error like below, although ./configure ran well.

What is the solution for this error above?

is it possible to build on jailbroken devices? Thanks

After i understand, how incremental analysis truly work. Now i have been wondering, me and my team did experiment on analysing Anubis's .xml into Malheur but somehow it show this kind of empty-ness.

Hi,

The new updates seem to have created an issue while running ./configure :

./configure: line 11905: syntax error near unexpected token LIBRARY_OPENMP="yes"' ./configure: line 11905:AX_OPENMP(LIBRARY_OPENMP="yes")'

$> grep AX_OPENMP *
configure:AX_OPENMP(LIBRARY_OPENMP="yes")
configure.ac:AX_OPENMP(LIBRARY_OPENMP="yes")

$> grep LIBRARY_OPENMP *
configure:AX_OPENMP(LIBRARY_OPENMP="yes")
configure:if test "x$LIBRARY_OPENMP" != "x" &&
configure.ac:AX_OPENMP(LIBRARY_OPENMP="yes")
configure.ac:if test "x$LIBRARY_OPENMP" != "x" && \

I think something isn't defined correctly.
I'm doing it on a Ubuntu 15.04

Thank you.

Pierre

When compiling malheur on my Ubuntu 15.04, I have the following issue:

gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -DNDEBUG -std=c99 -fgnu89-inline -Wall -fPIC -fopenmp -MT mconfig.o -MD -MP -MF .deps/mconfig.Tpo -c -o mconfig.o mconfig.c
mv -f .deps/export.Tpo .deps/export.Po
gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -DNDEBUG -std=c99 -fgnu89-inline -Wall -fPIC -fopenmp -MT cluster.o -MD -MP -MF .deps/cluster.Tpo -c -o cluster.o cluster.c
mv -f .deps/fmath.Tpo .deps/fmath.Po
gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -DNDEBUG -std=c99 -fgnu89-inline -Wall -fPIC -fopenmp -MT quality.o -MD -MP -MF .deps/quality.Tpo -c -o quality.o quality.c
mv -f .deps/mconfig.Tpo .deps/mconfig.Po
gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -DNDEBUG -std=c99 -fgnu89-inline -Wall -fPIC -fopenmp -MT class.o -MD -MP -MF .deps/class.Tpo -c -o class.o class.c
mv -f .deps/class.Tpo .deps/class.Po
gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -DNDEBUG -std=c99 -fgnu89-inline -Wall -fPIC -fopenmp -MT murmur.o -MD -MP -MF .deps/murmur.Tpo -c -o murmur.o murmur.c
mv -f .deps/farray.Tpo .deps/farray.Po
gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -DNDEBUG -std=c99 -fgnu89-inline -Wall -fPIC -fopenmp -MT malheur.o -MD -MP -MF .deps/malheur.Tpo -c -o malheur.o malheur.c
mv -f .deps/murmur.Tpo .deps/murmur.Po
mv -f .deps/quality.Tpo .deps/quality.Po
mv -f .deps/cluster.Tpo .deps/cluster.Po
rm -f libmalheur.a
ar cru libmalheur.a md5.o util.o fvec.o ftable.o mist.o fmath.o export.o farray.o proto.o mconfig.o cluster.o quality.o class.o murmur.o
ranlib libmalheur.a
mv -f .deps/malheur.Tpo .deps/malheur.Po
/bin/bash ../libtool --tag=CC --mode=link gcc -g -O2 -DNDEBUG -std=c99 -fgnu89-inline -Wall -fPIC -fopenmp -static -o malheur md5.o util.o fvec.o ftable.o mist.o fmath.o export.o farray.o proto.o mconfig.o cluster.o quality.o class.o murmur.o malheur.o -lz -lconfig
libtool: link: gcc -g -O2 -DNDEBUG -std=c99 -fgnu89-inline -Wall -fPIC -fopenmp -o malheur md5.o util.o fvec.o ftable.o mist.o fmath.o export.o farray.o proto.o mconfig.o cluster.o quality.o class.o murmur.o malheur.o -lz -lconfig -fopenmp
util.o: In function prog_bar': /tmp/malheur/src/util.c:165: undefined reference tofloor'
/tmp/malheur/src/util.c:165: undefined reference to floor' /tmp/malheur/src/util.c:170: undefined reference toround'
/tmp/malheur/src/util.c:176: undefined reference to floor' /tmp/malheur/src/util.c:176: undefined reference tofloor'
fmath.o: In function fvec_dot': /tmp/malheur/src/fmath.c:299: undefined reference tolog2'
/tmp/malheur/src/fmath.c:299: undefined reference to ceil' fmath.o: In functionfvec_dist':
/tmp/malheur/src/fmath.c:271: undefined reference to sqrt' fmath.o: In functionfvec_norm2':
/tmp/malheur/src/fmath.c:489: undefined reference to sqrt' mconfig.o: In functionconfig_default':
/tmp/malheur/src/mconfig.c:197: undefined reference to lround' cluster.o: In functioncluster_murtagh._omp_fn.1':
/tmp/malheur/src/cluster.c:113: undefined reference to fmin' /tmp/malheur/src/cluster.c:122: undefined reference tofmax'
collect2: error: ld returned 1 exit status
Makefile:419: recipe for target 'malheur' failed
make[3]: *** [malheur] Error 1
make[3]: Leaving directory '/tmp/malheur/src'
Makefile:326: recipe for target 'all' failed
make[2]: *** [all] Error 2
make[2]: Leaving directory '/tmp/malheur/src'
Makefile:395: recipe for target 'all-recursive' failed
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory '/tmp/malheur'
Makefile:326: recipe for target 'all' failed
make: *** [all] Error 2

I think the -lm flags for linking is missing somewhere.
By adding it to LDFLAGS directly into the Makefile I can solve this issue.

Thank you

Pierre

Link for malheur data set are not working anymore. Instead they are redirecting to http://dws.informatik.uni-mannheim.de/en/~rgemulla page.

Can someone correct the website link or either provide me a data set here. Thanks

When I tried to run malheur 0.5.4 after installing it from source on Ubuntu 14.04 LTS, I got:

Error: Could not open file '/usr/local/var/malheur/malheur.cfg'.: Permission denied [copy_file]
Error: Could not read configuration (file I/O error in line 0): No such file or directory [load_config]

The file /usr/local/var/malheur/malheur.cfg doesn't exist. Shouldn't a default configuration come with the install? If not, how can I create it?

Whenever I run Malheur in increment mode and feed it one report at a time, I don't get any results, forcing me to rerun it against all previous reports. This yields a noticeable overhead of processing time that likely shouldn't need to be done I'd imagine. Using increment mode with a batch of reports seems to produce the desired results, but I am not able to do this automatically as our system (Cuckoo) feeds reports out one-by-one. Would there be any chance to support single reports in increment mode?

See more details on our bug tracker
http://code.google.com/p/pentoo/issues/detail?id=83

Hi I want to apply Naive Bayes classification technique on cuckoo reports via Malheur Malware Analysis. For that I want to get information about Malheur's classification technique which is already enabled in it. Which classification technique is coded in malheur ?
Thanks in advance for valuable answers..

Reported this privately already, but for the benefit of others that run into it, the patch to fix the issue is:

diff --git a/src/class.c b/src/class.c
index fe9f0d4..3830e8e 100644
--- a/src/class.c
+++ b/src/class.c
@@ -115,10 +115,12 @@ assign_t *class_assign(farray_t *fa, farray_t *p)
             }
         }

-        /* Compute assignments */
-        c->proto[i] = j;
-        c->dist[i] = min;
-        c->label[i] = p->y[j];
+       if (p->len) {
+               /* Compute assignments */
+               c->proto[i] = j;
+               c->dist[i] = min;
+               c->label[i] = p->y[j];
+       }

         if (c->dist[i] > maxdist)
             c->label[i] = 0;

Without this, a NULL deref will be hit on the read from p->y[j]. Might not be the correct fix, but it resolves the crash at least.

Whether I can use the original XML representation of CWSandbox as the input of Malheur,or I must change the original XML with MIST.

Program terminated with signal SIGSEGV, Segmentation fault.
#0 extract_wgrams (nlen=2, l=,

x=0x7fe850000c20 '\n' <repeats 200 times>..., fv=0x7fe8500009e0)
at fvec.c:383

383 if (t[j - 1] != d)
(gdb) bt
#0 extract_wgrams (nlen=2, l=,

x=0x7fe850000c20 '\n' <repeats 200 times>..., fv=0x7fe8500009e0)
at fvec.c:383

#1 fvec_extract (x=x@entry=0x7fe850000c20 '\n' <repeats 200 times>..., l=203,

s=<optimized out>) at fvec.c:180

#2 0x0000000000409551 in farray_extract_dir._omp_fn.1 () at farray.c:337
#3 0x00007fe86542b34a in ?? () from /usr/lib/x86_64-linux-gnu/libgomp.so.1
#4 0x00007fe86520d182 in start_thread (arg=0x7fe863e4e700)

at pthread_create.c:312

#5 0x00007fe864f3a47d in clone ()

at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

(gdb) print j
$1 = 0

Hi team,

I've noticed that after a "make clean" the file "malheur.h" is removed. This file must be dinamically created in the compilation process, but the file "malheur.h.in" is missing. Then it's not possible to build the code after run "make clean". First time I try to build the code it runs fine because "malheur.h" is downloaded from the repo.

Regards

aclocal: error: aclocal: file '/usr/local/share/aclocal/argz.m4' does not exist

Run brew doctor and then brew prune

I want to know that whether the Malheur contains the function can gain the reports of malware behavior if I have some new samples.

Hi there, is there any possible way to create MIST for static representation?

currently i'm taking my thesis firstly trying to learn the essence of this Malheur. What stumbled me first, due to my lack of knowledge about installing via VM and Linux (in Ubuntu server 12.04) command.
I am wondering that, there are some sort of additional application needed by fully running these two:
libconfig-1.4.9.tar.gz
libarchive-3.1.2.tar.gz(Stable one according to its original web)

Some of those additional applications are:
Gcc
G++
flex, bison (these 2 are optional, tho i'm still tempted to include them)
PKG-CONFIG
zlib-1.2.8 (currently this is the newest stable)

now i can run Malheur, yet i'm just afraid that because off redundancy package that is not really needed might jumbled everything. Or is it just fine since i did:

• find in /usrl/local/bin/...malheur (in green color)
  
• and malheur can be executed anywhere, now i just need to figure out how to put dataset.zip in there, run it, and then i can learn its essence.

wrapping up those questions above:

• are those packets using apt-get are not going to be hindrance for malheur? or simply, just knowing malheur can run, there is no need to worrysome :> ?
• how exactly can i run dataset.zip from malheur? important

I get this when I run bin/malheur

The only switch that works is ./malheur -h

I assume that there is a configuration file that I need to load...but I'm not sure where that should be.

Is there a "readme" on how to use this?

I am currently learning the analysis part of Malheur version 0.4.6. As i used the dataset of reference_mist.tar.gz from http://pi1.informatik.uni-mannheim.de/malheur/. i can get the similar result as posted in the web. But is it possible to get the similar result like this picture below ?

source from: Automatic Analysis of Malware Behavior using Machine Learning paper.

My hipothesis is that "prototype" list in each malheur machine may cause differences in doing incremental analysis result, even though analysis the same dataset.

My approach is: using dataset of application data set 1 - 7 similar like the paper and put them in the command in sequence but i did clustering not incremental analysis. Because in incremental analysis i cannot see "number of cluster.

Here is what my machine produced: