Host-Based Malware Variants Detection Method Using Logs
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Enterprise networks in the PyeongChang Winter Olympics were hacked in February 2018. According to adomestic security company’s analysis report, attackers destroyed approximately 300 hosts with the aim ofinterfering with the Olympics. Enterprise have no choice but to rely on digital vaccines since it is overwhelmingto analyze all programs executed in the host used by ordinary users. However, traditional vaccines cannotprotect the host against variant or new malware because they cannot detect intrusions without signatures formalwares. To overcome this limitation of signature-based detection, there has been much research conductedon the behavior analysis of malwares. However, since most of them rely on a sandbox where only analysistarget program is running, we cannot detect malwares intruding the host where many normal programs arerunning. Therefore, this study proposes a method to detect malware variants in the host through logs rather thanthe sandbox. The proposed method extracts common behaviors from variants group and finds characteristicbehaviors optimized for querying. Through experimentation on 1,584,363 logs, generated by executing 6,430malware samples, we prove that there exist the common behaviors that variants share and we demonstrate thatthese behaviors can be used to detect variants.
Abstract
Enterprise networks in the PyeongChang Winter Olympics were hacked in February 2018. According to adomestic security company’s analysis report, attackers destroyed approximately 300 hosts with the aim ofinterfering with the Olympics. Enterprise have no choice but to rely on digital vaccines since it is overwhelmingto analyze all programs executed in the host used by ordinary users. However, traditional vaccines cannotprotect the host against variant or new malware because they cannot detect intrusions without signatures formalwares. To overcome this limitation of signature-based detection, there has been much research conductedon the behavior analysis of malwares. However, since most of them rely on a sandbox where only analysistarget program is running, we cannot detect malwares intruding the host where many normal programs arerunning. Therefore, this study proposes a method to detect malware variants in the host through logs rather thanthe sandbox. The proposed method extracts common behaviors from variants group and finds characteristicbehaviors optimized for querying. Through experimentation on 1,584,363 logs, generated by executing 6,430malware samples, we prove that there exist the common behaviors that variants share and we demonstrate thatthese behaviors can be used to detect variants.
참고문헌 (13)
- "Hacking into PyeongChang Winter Olympics: a long time ago carefully prepared APT, system destruction attack" (2018)[URL]
- "The Untold Story of the 2018 Olympics Cyberattack, the Most Deceptive Hack in History" (2019)[URL]
- 최상용, "Automated Link Tracing for Classification of Malicious Websites in Malware Distribution Networks", JIPS(Journal of Information Processing Systems), 15(1), pp.100~115 (2019), 한국정보처리학회[DOI]
- Humaira Arshad, "Digital Forensics: Review of Issues in Scientific Validation of Digital Evidence", JIPS(Journal of Information Processing Systems), 14(2), pp.346~376 (2018), 한국정보처리학회[DOI]
- A. Souri, "A state-of-the-art survey of malware detection approaches using data mining techniques", Human-centric Computing and Information Sciences, 8 (2018)
- "Research for malware mutants group identification based on data mining" (2017)[URL]
- "Latest malware statistics and trends report" (2021)[URL]
- T. G. Kim, "Code Reuse Analysis Techniques for Detection of Malware Variant", Journal of the Korea Institute of Information Security and Cryptology, 24(1), pp.32~38 (2014)
- J. Zhang, "Sensitive system calls based packed malware variants detection using principal component initialized multilayers neural networks", Cybersecurity, 1 (2018)
- 박성빈, "자동화된 도구에 의해 생성된 변종 악성코드의 공통 속성을 이용한 탐지 방법", 한국정보기술학회논문지, 10(9), pp.67~75 (2012), 한국정보기술학회
- 문대성, "APT 공격 탐지를 위한 호스트 기반 특징 표현 방법", 정보보호학회논문지, 24(5), pp.839~850 (2014), 한국정보보호학회[DOI]
- 강세림, "윈도우 이벤트 로그 기반 기업 보안 감사 및 악성코드 행위 탐지 연구", 정보보호학회논문지, 28(3), pp.591~603 (2018), 한국정보보호학회[DOI]
- "Sysmon v13.23" (2021)[URL]