머신러닝 기반 손상된 디지털 파일 내부 은닉 악성 스크립트 판별 시스템 설계 및 구현
Design and Implementation of a ML-based Detection System for Malicious Script Hidden Corrupted Digital Files
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 MS Office 파일 내에 악성 스크립트 등이 은닉된 멀웨어 파일이 발견되고 있다. 이에 본 논문에서는 머신러닝 기법을 적용하여 악성 디지털 파일을 자동으로 검출할 수 있는 시스템을 설계 및 구현하였다. MS Office 파일내 OLE VBA 매크로 기능을 악용하여 악성 스크립트를 검출하거나, OOXML 구조 분석을 통해 CDH/LFH/ECDH 내부 필드 값에 악성 스크립트를 탐지하고, OOXML 구조에서 참조되지 않는 비정상적인 CDH/LFH 정보를 추가한경우 이를 검출할 수 있는 메커니즘을 제시하였다. 그리고 VirusTotal 악성 스크립트 판별 기능을 이용하여 MS Office 파일에 대한 악의적 손상 여부 자동 판별하는 기능을 이용하여 머신러닝 기반 통합 소프트웨어를 설계 및 구현하였다. 실험 결과 파일 손상 여부를 자동 판별할 수 있으며 최적의 머신러닝 모델을 이용하여 임의의 MS Office 파일에 대해향상된 검출 성능을 제공하는 것을 확인하였다.
Abstract
Malware files containing concealed malicious scripts have recently been identified within MS Office documents frequently. In response, this paper describes the design and implementation of a system that automatically detects malicious digital files using machine learning techniques. The system is proficient in identifying malicious scripts within MS Office files that exploit the OLE VBA macro functionality, detecting malicious scripts embedded within the CDH/LFH/ECDR internal field values through OOXML structure analysis, and recognizing abnormal CDH/LFH information introduced within the OOXML structure, which is not conventionally referenced. Furthermore, this paper presents a mechanism for utilizing the VirusTotal malicious script detection feature to autonomously determine instances of malicious tampering within MS Office files. This leads to the design and implementation of a machine learning-based integrated software. Experimental results confirm the software's capacity to autonomously assess MS Office file’s integrity and provide enhanced detection performance for arbitrary MS Office files when employing the optimal machine learning model.
참고문헌 (18)
- "Ecma-376 office open xml file formats"[URL]
- A. M. Naser, "Analyzing and detecting malicious content : Docxfiles", International Journal of Computer Science and Information Security, 14(8), pp.404~ (2016)
- P. Singh, "Detection of Malicious OOXML Documents Using Domain Specific Features", Master, pp.2017
- Z. Wang, "Applications of Machine Learning in Public Security Informatin and Resource Management", Hindawi Scientific Programming, 2021 (2021)
- Y. Liu, "Blockchain and machine learning for communications and networking systems", IEEE Communications Surveys &Tutorials, 22(2), pp.1392~1431 (2020)
- R. Gupta, "Machine learning models for secure data analytics : a taxonomy and threat model", Computer Communications, 153, pp.406~440 (2020)
- A. Cohen, "Sfem : Structural feature extraction methodology for the detection of malicious office documents using machine learning methods", ExpertSystems with Applications, 63, pp.324~343 (2016)
- 이한성, "Forgery Detection Mechanism with Abnormal Structure Analysis on Office Open XML based MS-Word File", The International Journal of Advanced Smart Convergence, 8(4), pp.47~57 (2019), 한국인터넷방송통신학회[DOI]
- S. Na, "Implementation of Malicious Data Analysis and Detection System Hidden in the Slack Space of Corrupted OOXML-based MS-Office Digital Files", Advanced and Applied Convergence Letters AACL 21 (9th International Joint Conference on Convergence, IJCC2023), pp.97~103 (2023)
- A. Catsiglione, "Hiding Information into OOXML Documents : New Steganographic Perspectives", Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, 2(4), pp.59~83 (2011)
- S. D. l. Santos, "Macro malware detection using machine learning techniques - a new approach", Proceedings of the 3rd International Conference on Information SystemsSecurity and Privacy, 1, pp.295~302 (2017), ICISSP, INSTICC. SciTePress
- S. Kim, "Obfuscated vba macro detection using machine learning", 201848th Annual IEEE, 2018, 490~501
- FireEye, "Malicious PowerShell Detection via Machine Learning", ~ (2018)
- B. Mahesh, "Machine Learning Algorithms – A Review", International Journal of Science and Research, 9(1) (2020)
- W. Richert, "Building Machine Learning Systems with Python", Packt Publishing Ltd
- "VirusTotal"[URL]
- "Python"[URL]
- "scikit-learn"[URL]