Contract No.: 285248 Strategic Objective
Malware Detection Service Open API Specification
Download 1.78 Mb.
|
- Navigate this page:
- 26.1.2Intended Audience
- 26.1.4How to Read This Document
- 26.1.5Additional Resources
- 26.2General Malware Detection Service Information
- 26.2.3Representation Format
- 26.2.5Resource Identification
- Malware Detection Engine Limits
- 26.2.8Versions We are V1.0 release. 26.2.9Extensions
- 26.3Malware Detection Service Operations
- Distance vector of a binary file
26Malware Detection Service Open API Specification26.1Introduction to Malware Detection Service26.1.1Malware Detection Service CoreThis document provides a description of the available interface for submitting a binary file to malware detection service. 26.1.2Intended AudienceThis document is addressed to both software developers and to the consumers of malware detection service. 26.1.3Service Change HistoryThe most recent changes are described in the table below:
26.1.4How to Read This DocumentThe following list summarizes these special notations.
For a description of some terms used along this document, see the Architecture Description document. 26.1.5Additional ResourcesAdditional information about WSO2 Application Server and Enterprise Service Bus open source solution can be found on official WSO2 Documentation Web Pages:
26.2General Malware Detection Service Information26.2.1Resources SummaryThe WSDL description file is delivery at http://av.loria.fr:8280/services/AV?wsdl2 or you can find a representation in annexes section of "User and Programmers Guide". Web portal of Malware Service is accessible from URL https://av-portail.loria.fr (152.81.67.99). Once authenticated, you can submit a binary to Malware Service directy from your browser and display the result. 26.2.2AuthenticationThe restrict access to malware detection service is based on WS-Security Username Token specifications. So you must send an email to INRIA Carte Team for receiving your login/password authentication. 26.2.3Representation FormatThe Malware Dection Service supports the SOAP protocol. The request and the response format are specified using the XML Content-Type header. 26.2.4Representation TransportLocal binary file is transmitted to server via MTOM. 26.2.5Resource IdentificationIntegrity and confidentiality in transport binary and response are supported by "rampart module from Apache Software Foundation" 26.2.6Links and ReferencesReport to "Additional Resources" for references. 26.2.7LimitsMalware Detection Engine LimitsMalware Detection engine is a software capable of extracting (partly) a morphological signature from executable binary code, that corresponds to the behavior of malware.
Absolute LimitsUnder test. 26.2.8VersionsWe are V1.0 release. 26.2.9ExtensionsTwo extensions are forecasted for the moment:
26.2.10FaultsThe faults are saved in log files and also indicated on line when executing. 26.3Malware Detection Service OperationsScan a binary file
Data type ScanWrapper is composed by a complex type (DataRequest) that has itself 4 parameters: 1- filename: name of the binary file to scan 2- binaryData: binary file body transformed into base64 format 3- mode: scan mode switch between static (default) and dynamic 4- sha256: binary file hash in SHA-256 format
Data type ResponseWrapper is composed by 1 parameter: 1- result: Will indicate INFECTED for an infected binary file, SANE otherwise This action makes any submitted a binary file to be scanned by Morphus, which itself will answer either 'INFECTED' for an infected binary file, or 'SANE' otherwise. Distance vector of a binary file
Data type DistanceWrapper is composed by a complex type (DataRequest) that has itself 4 parameters: 1- filename: name of the binary file to scan 2- binaryData: binary file body transformed into base64 format 3- mode: scan mode switch between static (default) and dynamic 4- sha256: binary file hash in SHA-256 format
Data type ResponseWrapper is composed by 1 parameter: 1- result: Will indicate the distance from malwares that are already in database This action also submits a binary to the scanner, but in this case, Morphus will reply with the distance from malwares that are already in database. (example: Backdoor.Win32.Hupigon.bto: 100.00% Backdoor.Win32.Hupigon.bto, 59.33% Backdoor.Win32.Hupigon.bhes, 6.57% Packed.Win32.CPEX-based.e)
List malware database
Data type MalwareListRequest is composed by 1 parameter: 1- limit: maximum malware names in the list (0 for unlimited)
Data type ResponseWrapper is composed by 1 parameter: 1- result: Will indicate the malwares list This action provides a listing of malware's name in the database. Download 1.78 Mb. Share with your friends:
|