BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.balccon.org//balccon2k26-2026//talk//PQ9QZT
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-balccon2k26-2026-PQ9QZT@cfp.balccon.org
DTSTART;TZID=CET:20260918T160000
DTEND;TZID=CET:20260918T170000
DESCRIPTION:This talk is about using LLMs to build and modernize software w
 here correctness matters. It follows the work at two scales: modernizing a
  similarity-digest algorithm that must match its reference implementation 
 bit-for-bit\, and building malbench\, a local-first triage and clustering 
 workbench for malware analysts.\nmalbench is a local-first triage and clus
 tering workbench for malware analysts. It pulls samples and threat intelli
 gence from various sources\, computes similarity digests\, runs YARA rules
 \, and then turns a flat pile of hashes into structure: it clusters and gr
 aphs files by features they actually share and weaves several of those len
 ses into a single view.\nI needed a wider variety of hashing algorithms\, 
 so in addition to ssdeep and TLSH\, I took a dormant 2021 Go port of sdhas
 h\, a similarity-digest algorithm used in malware triage and code-reuse de
 tection\, and modernized it into a clean\, dependency-free\, fully-tested 
 library. A deterministic verification corpus and parallel C++/Go harnesses
  turn the original reference implementation into an oracle: millions of pa
 ir comparisons\, zero unexplained divergences. Around that sit total test 
 coverage as a drift alarm\, strict session and context hygiene\, profile-b
 efore-you-optimize with one change measured at a time. The result is a rep
 eatable process for adopting and modernizing old code and for building new
  tools on top of it.
DTSTAMP:20260901T071137Z
LOCATION:Tesla
SUMMARY:Comparing Malicious Files 2.0 - Malware Utkonos
URL:https://cfp.balccon.org/balccon2k26-2026/talk/PQ9QZT/
END:VEVENT
END:VCALENDAR