AIS2023-3.pdf (10 MB)

The DailySecu AIS presentation introduces Deep Binary Profiler, an AI-assisted malware profiling approach that compares assembly-code functions to identify reuse across known threats. Its North Korea examples include the 2013 3.20 attack, Sony Pictures, Interpark, WannaCry, and a slide illustrating how analysts might support Lazarus attribution with reused functions and ATT&CK behaviors such as T1082 or T1497. The DBP workflow separates binaries into functions, embeds assembly code for similarity measurement, removes noisy functions, and carries forward labels from prior analyses. For DPRK tracking, the useful point is the claimed ability to trace Lazarus-related function reuse and variants, including a case-study section on Lazarus Destover.