DHS · DHS-107 · record R1833

Malware Reverse Engineering

Department of Homeland Security · CISA

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not reported
Start date: Not reported
Withheld from public reporting: Not reported

Mission

Topic area: Cybersecurity
Operational functions: Cyber threat detection, Risk scoring and triage Derived by keyword rules; see methodology

Problem the AI is intended to solve

This AI capability uses deep learning to assist CISA analysts with understanding the content of malware samples, automating tasks such as triage and indicator extraction.

Expected benefits

This use case delivers improved internal government tools for reverse engineering of malware and speeding the development of cyber threat intelligence that can be shared across the government and with CISA partners. Threat actors can leverage the same malware for long periods of time, so having the ability to improve analysis and generation of shareable cyber threat intelligence forces threat actors to spend more resources generating new malware. Machine learning and other analytical tools are leveraged to guide malware analysts and automate elements of the manual reverse engineering process. Automation of tasks such as triage and indicator extraction allow threat hunting analysts to meet high demand and focus more on adversary response.

System outputs

A report is generated from malware samples submitted to the analysis pipeline that is then used by human analysts to facilitate the malware triage process. Additional recommendations are displayed via plugins to reverse engineering tools.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): Not reported
Custom-developed code: Not reported
Public source code: Not reported

Sourcing

How it was built: Not reported
Vendor (as reported): Not reported
Vendors (standardized): None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Not reported
Privacy Impact Assessment: Not reported
Authorization to Operate: Not reported
Demographic features: Not reported
Training and evaluation data: Not reported
Federal Data Catalog: Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingNo answer reported

AI impact assessmentNo answer reported

Independent reviewNo answer reported

Ongoing monitoringNo answer reported

Operator trainingNo answer reported

Fail-safeNo answer reported

Appeal processNo answer reported

User and public consultationNo answer reported

Potential impacts and how they were identified

Not reported