Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding support for QuoVadis models #36

Open
zangobot opened this issue Jul 20, 2022 · 2 comments
Open

Adding support for QuoVadis models #36

zangobot opened this issue Jul 20, 2022 · 2 comments
Labels
help wanted Extra attention is needed

Comments

@zangobot
Copy link
Collaborator

zangobot commented Jul 20, 2022

Include wrappers for QuoVadis, by leveraging the fusion models provided inside the original repository by @dtrizna.
It should be implemented as a CQuoVadisClassifier and its wrapper for blackbox attack CQuoVadisWrapperPhi.

The only problem is data preprocessing, as the original code leverage file paths (and later it extracts binaries from them).

@zangobot zangobot added the help wanted Extra attention is needed label Jul 20, 2022
@dtrizna
Copy link

dtrizna commented Jul 20, 2022

Note on: The only problem is data preprocessing, as the original code leverage file paths (and later it extracts binaries from them).

In all Speakeasy API documentation, it was defined to use filepath of PE, but I see that .load_module() can take both path= (path) and data= (bytes) as parameters:
https://github.com/mandiant/speakeasy/blob/master/speakeasy/speakeasy.py#L190

I will consider updating QuoVadis API so it allows specifying bytes in preprocessing stage.

@zangobot
Copy link
Collaborator Author

Ok thank you!
I will look into that, as it would be amazing to have QuoVadis inside SecML malware!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted Extra attention is needed
Projects
None yet
Development

No branches or pull requests

2 participants