セキュリティ・キャンプ2018 Z3成果報告

セキュリティ・キャンプ2018全国大会のZトラック、Z3での成果報告の資料です。
丸3日間YARAの高速化に挑戦し、場合によりますが10倍以上の高速化に成功しました！

Transcript

1. Z3 YARA
    @aokabit @tubutubu_corn
2. YARA
    ▸      ▸YARA rules
   !  !"
3. YARA rules
4. YARA 
     ▸Aho-Corasick#  ▸Aho-Corasick     !
   "  
   
   
5. 
   Quick Search 
   
6. Quick Search ▸   ▸
    ▸
   
   
7. Quick Search ▸#$'  ▸+
   ,, ▸%*(& !
   
   %*(& -#. " ),
8. 
    ▸key(r) :=  r match
       " ▸1#r = /(abc*f)(dfe|dfc)(a*bb)/  key(r) = {ab, fdf, bb} ▸key(r)   !Quick Search
9.  Quick Search
    ▸%#   # 
    &!
   "   (SKIP) $''
10. SKIP
     ▸ (LENGTH)  ▸ 
     (ALPH) 
11. LENGTH
     ▸len(r) := min { |w| | w  r } ▸1  r = /ab*cd/
     len(r) = 3 ▸2 r = {A4 56 9?}
     len(r) = 3
12. ALPH
     ▸alph(r) := r  
     ▸ 1r = /[ab][cd]e*/ alph(r) = {a,b,c,d,e} ▸ 2r = {A5 B7 FF} alph(r) = {A5, B7, FF}
13. SKIP
     Z Z Z Z Z Z Z A Z A Z Z Z Z A Z r = [AB][CD][EF][GH] LENGTH = 4 ALPH = {ABCDEFGH} i = 0
14. SKIP
     Z Z Z Z Z Z Z A Z A Z Z Z Z A Z r = [AB][CD][EF][GH] LENGTH = 4 ALPH = {ABCDEFGH} LENGTH – 1
    i = 0
15. SKIP
     Z Z Z Z Z Z Z A Z A Z Z Z Z A Z r = [AB][CD][EF][GH] LENGTH = 4 ALPH = {ABCDEFGH} ZALPH 
    
      i LENGTHSKIP i = 0
16. SKIP
     Z Z Z Z Z Z Z A Z A Z Z Z Z A Z r = [AB][CD][EF][GH] LENGTH = 4 ALPH = {ABCDEFGH} i = 4 AALPH 
       
17. SKIP
     Z Z Z Z Z Z Z A Z A Z Z Z Z A Z r = [AB][CD][EF][GH] LENGTH = 4 ALPH = {ABCDEFGH} Z Z Z A r 
     SKIP i = 4
18. SKIP
     V.S YARA ▸SKIP   V.S YARA ▸SKIP 
     V.S YARA
19. SKIP  
     Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z r = [AB][CD][EF][GH] LENGTH = 4 ALPH = {ABCDEFGH}
20. SKIP 
     Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z r = [AB][CD][EF][GZ] LENGTH = 4 ALPH = {ABCDEFGZ}
21.  
     0 0.5 1 1.5 2 2.5 3 1B 10B 100B 1KB 10KB 100KB 1MB 10MB 100MB SKIP NOSKIP
     s ( )
22.  
     0 0.5 1 1.5 2 2.5 3 1B 10B 100B 1KB 10KB 100KB 1MB 10MB 100MB SKIP NOSKIP
     s ( )
23.   
      0 1 2 3 4 5 6 7 8 9 1B 10B 100B 1KB 10KB 100KB 1MB 10MB 100MB SKIP NOSKIP
     s ( )
24.   
      0 1 2 3 4 5 6 7 8 9 1B 10B 100B 1KB 10KB 100KB 1MB 10MB 100MB SKIP NOSKIP
     s ( )
25. 
    YARA 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 1.96GB (Ubuntu18.04.iso) SKIP NOSKIP
     s ( )
26. 
     ▸&% 
    10"! /.$ *# ▸SKIP (, -+  ')  . (){??}  (
27.  ▸&% 
    10"! /.$ *# ▸SKIP (, -+  ')  . (){??}  (