Comments on: Alex Dragulescu code art

Alex Dragulescu code art

Kronos_to_Earth — Wed, 05 Mar 2008 08:29:40 -0800

Gee. I think I'll uninstall my firewall and ditch the anti-virus. Malwares is pretty. via bbc.

By: middleclasstool

middleclasstool — Wed, 05 Mar 2008 08:42:13 -0800

Yes. Yes they is. That's a neat idea, thanks for the link.

By: KevinSkomsvold

KevinSkomsvold — Wed, 05 Mar 2008 08:42:33 -0800

So malware is simply a series of thinly disguised rhinoviruses? Awesome!

By: slogger

slogger — Wed, 05 Mar 2008 08:43:59 -0800

A link that says malware and leads to a .ro site?

By: shmegegge

shmegegge — Wed, 05 Mar 2008 08:47:23 -0800

I wish I knew enough about code to understand what the different pieces mean. It's really a pretty amazing visualization of the little buggers.

By: DU

DU — Wed, 05 Mar 2008 08:50:47 -0800

I would like to know more about this algorithm. Last I heard, virii were discovered based on signatures in the file. I never even thought about traffic analysis/call patterns. The distinctiveness would seem to indicate that you could recognize malware by "shape" in this parameter space in exactly the same way antibodies do it by shape in 3space.

By: KevinSkomsvold

KevinSkomsvold — Wed, 05 Mar 2008 08:57:20 -0800

A link that says malware and leads to a .ro site? What? No sense of adventure? Kids these days....

By: Kronos_to_Earth

Kronos_to_Earth — Wed, 05 Mar 2008 10:06:40 -0800

A link that says malware and leads to a .ro site? Oooops. Sorry. First post to the front page and I nearly wreck everyone's machine.... I checked this McAfee link and felt the hair on the back of my neck go up. My goodness. I had no idea. I've got the SiteAdvisor extension; it said the Dragulescu site was OK.

By: demiurge

demiurge — Wed, 05 Mar 2008 10:11:54 -0800

I doubt that these images have much to do with the input being computer viruses. I would bet that running notepad.exe through their algorithm would give similar sorts of patterns.

By: cecilkorik

cecilkorik — Wed, 05 Mar 2008 10:16:41 -0800

I wish I knew enough about code to understand what the different pieces mean. Maybe I'm just cynical, but I suspect the answer would be "almost nothing". They're just using the malware's function calls as inputs to their "make a pretty 3d rendering" algorithm, which they don't seem to provide any details about. It's a typical sensationalist trick to show patterns where there aren't any, chances are any patterns you see are coded into the algorithm, not a result of the input. I suspect you would get equivalently pretty pictures from any normal executable, or even pure random numbers. But again, I could just be cynical. It's a good post, anyway, the pictures are neat, but I think saying they're a result of the malware inputs might be stretching the truth a bit.

By: Pyry

Pyry — Wed, 05 Mar 2008 10:18:52 -0800

These are very beautiful, but I suspect the actual viruses are just acting as fancy seeds for a random number generator / hash function and that you could get the same results with nearly any source of randomness. Which is to say that although they're pretty, they aren't particularly informative as visualizations.

By: noble_rot

noble_rot — Wed, 05 Mar 2008 10:32:02 -0800

These are pretty useless without any information regarding the algorithm used to go from virus to image. I think Pyry nailed it. Some bit of memory occupied by the virus is just seeding a 3d fractal generator. You could probably take some random bit of your OS or web browser or whatever and, using whatever algorithm it is, come up with an equally pretty picture.

By: [son] QUAALUDE

[son] QUAALUDE — Wed, 05 Mar 2008 12:36:04 -0800

heeeey dittoheads! cool post, regardless

By: spiderskull

spiderskull — Wed, 05 Mar 2008 13:52:44 -0800

Wow, that's awesome. I doubt that these images have much to do with the input being computer viruses. I would bet that running notepad.exe through their algorithm would give similar sorts of patterns. Exactly my thoughts. The distribution in API calls is probably similar enough to generate a relatively homogeneous set of images, regardless of actual function of the program.

By: stavrosthewonderchicken

stavrosthewonderchicken — Mon, 10 Mar 2008 00:22:12 -0800

You know what makes me grumpy? When I spend about 30 minutes crafting a post, then realize that I'd forgotten to search for the main URL first, and realize that somebody'd already done it, but that it was in a kinda lazy one-link throwaway post. I hate that. Definitely check out some of Alex Dragulescu's other projects. His stuff may or may not meet your exacting standards for information visualization, but I reckon he does really interesting work.

By: stavrosthewonderchicken

stavrosthewonderchicken — Mon, 10 Mar 2008 00:35:45 -0800

(By the way, I'm not really grumpy about it.)