GView: A versatile assistant for security researchers

Abstract

We propose a tool, GView (Generic View), that is tailored to assist the investigation of possible attack vectors by providing guided analysis for a broad range of file types using automatic artifact identification, extraction, inference & coherent correlation, and meaningful & intuitive views at different levels of granularity w.r.t. revealed information. GView simplifies the analysis of every payload in a complex attack, streamlining the workflow for security researchers, and increasing the accuracy of the analysis. The ’generic’ aspect derives from the fact that it accommodates various file types and also features multiple visualization modes (that can be automatically configured for each specific file type). Our results show that the analysis time of an attack is significantly reduced by GView, compared to conventional tools used in forensics.