Sisyfos: A Modular and Extendable Open Malware Analysis Platform

Abstract

Sisyfos is a modular and extensible platform for malware analysis; it addresses multiple operating systems, including critical infrastructure ones. Its purpose is to enable the development and evaluation of new tools as well as the evaluation of malware classifiers. Sisyfos has been developed based on open software for feature extraction and is available as a stand-alone tool with a web interface but can be integrated into an operational environment with a continuous sample feed. We present the structure and implementation of Sisyfos, which accommodates analysis for Windows, Linux and Android malware.

Keywords

• malware analysis
• static malware analysis
• dynamic malware analysis
• malware classification
• machine learning
• random forest