명령어 빈도수 통계정보를 이용한 악성 스마트폰 앱 탐지 가능성 분석
Feasibility Analysis Using Instruction Frequency Statistics for Malicious App Detection
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
스마트폰 시장의 급성장과 각종 스마트폰 보급의 확대를 통해 스마트폰 이용자의 수가 급격한 속도로 증가하고 있다. 특히 개방형 시스템으로 이루어진 안드로이드 운영체제 기반의 스마트폰은 정상 앱 또는 악성 앱 개발자들에 의해 큰 관심이 집중되고 있으며, 특히 개방형 시스템으로 인해 발생되는 앱의 검증 부족으로 인한 다수의 취약점이 존재한다. 그리고 최근 안드로이드의 악성 앱의 급격한 증가가 이루어지고 있으며, 이에 따라 안드로이드 악성 앱에 대응하기 위한 연구가 활발히 진행되고 있다. 기존 PC 환경에서는 악성코드에 대응하기 위한 다양한 기술이 연구 개발되었는데, 그 중 명령어 빈도수 분석을 통한 악성코드 분석 방법은 급격히 증가하고 있는 악성코드를 신속하게 분석할 수 있는 방법 중의 하나로 연구되고 있다. 본 논문에서는 윈도우즈 운영체제에서의 악성코드 분석 방법 중의 하나인 명령어 빈도수 분석 방법을 스마트폰 용 악성코드 분석에 적용해 보고, 이 분석 방법을 이용한 탐지 가능여부를 분석한다. 또한 스마트폰 환경에서의 악성 앱 탐지를 위한 연구 방향을 제시한다.
Abstract
The number of smart phone users keeps increasing every year. The Android operating system becomes popular to application developers including attackers, and it is not feasible to inspect all the App’s uploaded to Android app markets. In these days, the number of malicious smart phone app’s is increased dramatically, and researches on this topic is quite active. There has been many researches on malicious software on PC, and instruction frequency analysis is one of ways to detect malicious software efficiently. In this paper, we applied the instruction frequency analysis method to analyze malicious App’s to find out the feasibility of the method in smartphone environments. In addition, we proposed research directions for malicious App detection.
참고문헌 (35)
- 강부중, "악성코드현황및탐지기술", 한국정보과학회 학회지, pp.44~53 (2012)
- Yajin Zhou, "Dissecting Android Malware: Characterization and Evolution", Proceedings of the 33rd IEEE Symposium on Security and Privacy (2012)
- Yajin Zhou, "Hey, You, Get off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets", Proceedings of the 19th Annual Network and Distributed System Security Symposium (NDSS '12) (2012)
- Lucas Davi, "Privilege escalation attacks on android", Proceedings of the 13th international conference on Information security, pp.346~360 (2010)
- Patrick P.F. Chan, "DroidChecker: Analyzing Android Applications for Capability Leak", Proceedings of the fifth ACM conference on Security and Privacy in Wireless and Mobile Networks (2012)
- Patrick P.F. Chan, "A Privilege Escalation Vulnerability Checking System for Android Applications", 13th IEEE International Conference on Communication Technologies, pp.681~686 (2011)
- Adrienne Porter Felt, "Permission re-delegation: attacks and defenses", Proceedings of the 20th USENIX conference on Security (2011)
- David Barrera, "A methodology for empirical analysis of permission-based security models and its application to android", Proceedings of the 17th ACM conference on Computer and communications security, pp.73~84 (2010)
- Asaf Shabtai, "Andromaly : a behavioral malware detection famework for android devices", Journal of Intelligent Information System, pp.161~190 (2012)
- Liang Xie, "pBMDS: A Behavior-based Malware Detection System for Cellphone Devices", Proceedings of the 3rd ACM conference on Wireless Network Security, pp.37~48 (2010)
- Thomas Blasing, "An Android Application Sandbox System for Suspicious Software Detection", Proceedins of the 17th ACM conference on Computer and Communications security, pp.73~84 (2010)
- Leonid Batyuk, "Using Static analysis for automatic assessment and mitigation of unwanted and malicious activities within android applications", Proceedings of the 2011 Malware Conference, pp.66~72 (2011)
- Intel Corporation, "Intel 64 and IA-32 Architectures Software Developer's Manual Volume 2B: Instruction Set Reference" (2010), N-Z, Intel Corporation
- 서정택, "가상환경을이용한악성코드탐지기술", 정보보호학회지, 17(4), pp.74~82 (2007)
- Abhishek Karnik, "Detecting Obfuscated Viruses Using Cosine Similarity Analysis", Proceedings of the First Asia International Conference on Modelling & Simulation, pp.165~170 (2007)
- Kyoung Soo Han, "Malware classification using instruction frequencies", Proceedings of the 2011 ACM Symposium on Research in Applied Computation, pp.298~300 (2011)
- "Developers"[URL]
- Stefan Brahler, "Analysis of the Android Architecture" (2010), Karlsruhe institute for technology
- 김정훈, "구글의안드로이드와안드로이드마켓", 한국콘텐츠학회지, 7(2), pp.29~36 (2009)
- 김평준, "안드로이드플랫폼과서비스기반의모바일 어플리케이션", 한국멀티미디어학회지, 15(1), pp.10~21 (2011)
- 심원태, "안드로이드 앱 악성행위 탐지를 위한 분석 기법 연구", 정보보호학회논문지, 21(1), pp.213~219 (2011), 한국정보보호학회
- Thomas Blasing, "An android application sandbox system for suspicious software detection", 5th International Conference on Malicious and Unwanted Software (MALWARE 2010), pp.55~62 (2010)
- "Sun Developer Network(SDN)"[URL]
- "Android Developers"[URL]
- "Android Developers"[URL]
- Enck William, "A Study of Android Application Security", Proceedings of the 20th USENIX Security Symposium (2011)
- Vadodil Joel Varghese, "Dissecting Andro Malware" (2011), SANS Institute Reading Room
- "smali"[URL]
- "dedexer"[URL]
- "Bytecode for the Dalvik VM"[URL]
- Robert Lyda, "Using Entropy Analysis to Find Encrypted and Packed Malware", Proceedings of the IEEE Symposium on Security and Privacy, pp.40~45 (2007)
- Welderufael Berhane Tesfay, "Reputation Based Security Model for Android Applications", Proceedings of the 11th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, pp.896~901 (2012)
- 천우봉, "스마트폰 악성코드 대응을 위한 모바일 보안 진단 시스템", 정보보호학회논문지, 22(3), pp.537~544 (2012), 한국정보보호학회
- Iker Burguera, "Crowdroid: Behavior-Based Malware Detection System for Android", Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices, pp.15~26 (2011)
- William Enck, "TaintDroid: An Information- Flow Tracking System for Realtime Privacy Monitoring on Smartphones", Proceedings of the 9th USENIX Symposium on Operating Systems Design and Implementation, pp.393~408 (2010)