Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: When a malware analyst analyzes some code to determine if it's malicious or not and what it is doing, he has to overcome protections built in by malware writer that tries to make it as hard as possible to get to the main functionality of the malware code. In practice that means that when malware analyst, while stepping through the code in some debugger like OllyDbg, hits call instruction or something similar has to decide if he is going to follow call or skip over it. Obviously, if the call is unimportant the best would be to skip it, but at that point analyst doesn't know if it is important or not. The problem is that creative malware writer can use anti debug techniques in such a way that they are hard to recognize and analyze, they can even come up with a new ways to make malware analysis harder. So, the question is is it possible to write a plugin for a debugger that, based on the current call instruction and data behind it, can suggest malware analyst what to do?   present a system that  are designing and developing that would allow experiments to be performed to find out the ansr to the aforementioned question.
['Igor Novkovic', 'Stjepan Gros']
I am writing a research paper on a idea Can malware analysts be assisted in their work using techniques from machine learning
[{"from": "human", "value": "I am writing a research paper on a idea Can malware analysts be assisted in their work using techniques from machine learning"}, {"from": "gpt", "value": "Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: When a malware analyst analyzes some code to determine if it's malicious or not and what it is doing, he has to overcome protections built in by malware writer that tries to make it as hard as possible to get to the main functionality of the malware code. In practice that means that when malware analyst, while stepping through the code in some debugger like OllyDbg, hits call instruction or something similar has to decide if he is going to follow call or skip over it. Obviously, if the call is unimportant the best would be to skip it, but at that point analyst doesn't know if it is important or not. The problem is that creative malware writer can use anti debug techniques in such a way that they are hard to recognize and analyze, they can even come up with a new ways to make malware analysis harder. So, the question is is it possible to write a plugin for a debugger that, based on the current call instruction and data behind it, can suggest malware analyst what to do?   present a system that  are designing and developing that would allow experiments to be performed to find out the ansr to the aforementioned question."}]