Nurilab - MINOSS

Product Overview

MINOSS is a big data-driven cyber threat analysis, detection, and response platform. It collects and analyzes diverse malware and threat samples, and uses code block-level similarity analysis technology to rapidly identify new and variant malware. By analyzing the structure and behavior of malware from a "code DNA" perspective, MINOSS identifies related threats and tracks attack families and variants, enabling organizations to identify cyber threats more quickly and proactively respond.

Key Advantages

01. KISA Selection of Excellent Information Protection Technology

Selected as an Excellent Information Protection Technology by the Korea Internet & Security Agency (KISA) in 2021

02. Patent registration and certification for related technologies

Patent registration for the technology ‘Method for building inverted index, method and apparatus searching similar data using inverted index’ and acquisition of GS certification grade 1

03. Based on large-scale threat data

Collecting and learning from hundreds of thousands of threat samples daily, both domestically and internationally. Detection accuracy is enhanced based on a large data base.

04. Advanced Similarity Analysis Technology

Rapid identification of new and variant malware using code DNA similarity-based detection, a high-speed similarity search algorithm utilizing patented technology.

05. Malware Detection Using Artificial Intelligence

Learning whether the function OPCode is malicious or normal using the VDCNN algorithm (applied to Windows executables and Linux executables)

Core Functions

Generate IDA-based function code blocks

Automatically organizes malware into function-based code blocks using the IDB generated by IDA, and even reflects renamed function names to improve analysis accuracy.

Function code block similarity analysis

Explore code similarity (percentage) and related samples through 1:1, 1:N, and N:N comparisons, and support variant and family analysis through assembly-level comparisons.

Malware information extraction and analysis

Automatically extracts key clues such as internal file strings, URL/HTTP addresses, and traces hidden malware analysis flow even within various compressed formats.

Tag-based malware detection

Search for similar malware by rank based on tags assigned to samples and DB-related information, enabling quick selection of relevant samples during incident response.

Static analysis of MS-Office documents

Analyzes the meta information and body content of Word/Excel/PowerPoint documents, and even checks the attached macro source to quickly determine whether there is document-type malware.

Static analysis of executable files (PE)

It provides meta information of PE file, Import/Export API, section structure, digital signature information, and allows static view of execution logic through disassembly view.

Analysis of Hangul (HWP) documents

Analyze HWP's OLE structure (Storage/Stream), decompress the compressed stream to check the text, images, and scripts, and also check 3.x/5.x vulnerability information.

File information and similarity exploration

Integrity is verified by hash (MD5/SHA1/SHA256), tag, and code block-by-block hash, and similar malware and PE function unit similarity results are also provided.

Products

Resources

Company

AI and big data-based security products

Content analysis-based security products

Global Partner Products

Big Data-Based Cyber Threat Detection and Response Platform

Key Advantages

Core Functions

Analysis Process

System Architecture

Contact

Solve cybersecurity threats with Nurilab!