PE 파일 분석을 위한 함수 호출 그래프 생성 연구
Generating Call Graph for PE file
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
다양한 스마트 기기의 보급으로 인하여 악성코드로 인한 피해를 더욱 심각해지면서 머신러닝 기술을 활용한 악성코드 탐지 기술이 주목 받고 있다. 그러나 코드의 단편적인 특성만을 기반으로 머시러닝의 학습 데이터를 구성할 경우, 이를 회피하는 변종 및 신종 악성코드는 여전히 제작하기 쉽다. 이와 같은 문제를 해결하기 위한 방법으로 악성코드의 함수호출 관계를학습 데이터로 사용하는 연구가 주목받고 있다. 특히, GNN을 활용하여 그래프의 유사도를 측정함으로써 보다 향상된 악성코드 탐지가 가능할 것으로 예상된다. 본 논문에서는 GNN을 악성코드 탐지에 활용하기 위해 바이너리 코드로부터 함수 호출그래프를 생성하는 효율적인 방안을 제안한다.
Abstract
As various smart devices spread and the damage caused by malicious codes becomes more serious, malicious codedetection technology using machine learning technology is attracting attention. However, if the training data of machinelearning is constructed based on only the fragmentary characteristics of the code, it is still easy to create variants andnew malicious codes that avoid it. To solve such a problem, a research using the function call relationship of maliciouscode as training data is attracting attention. In particular, it is expected that more advanced malware detection will bepossible by measuring the similarity of graphs using GNN. This paper proposes an efficient method to generate afunction call graph from binary code to utilize GNN for malware detection.
참고문헌 (15)
- "Malware hidden site detection trend report in the second half of 2020" (2021)[URL]
- M. Singh, "Security analysis of intelligent vehicles: Challenges and scope", 2017International SoC Design Conference (ISOCC),, pp.5~8 (2017)
- E. Amer, "A dynamic Windows malware detection and prediction method based on contextual understanding of API call sequence", Computers & Security (2020)
- A. Ahmed, "Improving the Detection of Malware Behaviour Using Simplified Data Dependent API Call Graph", International Journal of Security and Its Applications, 7(5), pp.29~24 (2013)[DOI]
- Lee, Taejin, "Trends in intelligent malware analysis technology using machine learning", Korea Institute of Information Security and Cryptology, 28(2), pp.12~19 (2018)
- "Malware characteristic information for using artificial intelligence technolog"[URL]
- "Metamorphic Detection Using Function Call Graph Analysis"[URL]
- "Function Call Graph Score for Malware Detection"[URL]
- D. Rajeswaran, "book: Guide to Vulnerability Analysis for Computer Networks and Systems", pp.259~279 (2018)
- J. Bai, "A Malware and Variant Detection Method Using Function Call Graph Isomorphism", Security and Communication Networks, 2019 (2019)[DOI]
- Z. Liu, "Introducation to Graph Neural Networks" (2020), Morgan & Claypool Publishers
- Minghui Cai, "Learning features from enhanced function call graphs for Android malware detection", Neurocomputing, 423, pp.301~307 (2021), Elsevier BV[DOI]
- T. Toma, "An efficient mechanism of generating call graph for JavaScript using dynamic analysis in web application", International Conference on Informatics, Electronics & Vision (ICIEV) (2014)
- D. Andriesse, "An In-Depth Analysis of Disassembly on Full-Scale x86", x64 Binaries, 2016, 583~600
- S. Yang, "A Real-Time and adaptive-Learning Malware Detection Method Based On API-Pair Graph", IEEE Access, 8, pp.120~113 (2020)[DOI]