Unknown 악성코드 분석을 위한 AI 기반 시각화 플랫폼
AI-based Visualization Platform for Analysis of Unknown Malware
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
AI 기반 악성코드 분석은 기존의 패턴 기반 백신 엔진에서 탐지하지 못하던수많은 변종 및 신종 악성코드를 인공지능 기술을 활용하여 분석하고 탐지하기위한 기술이다. AI 기반 악성코드 분석 및 탐지 기술은 악성코드 패턴을 미리정의해둘 필요가 없어 상대적으로 백신 엔진을 경량화할 수 있다. 본 논문에서는변종 및 신종 악성코드를 분석하고 탐지하기 위한 딥러닝 기반 탐지 시스템과탐지 결과를 확인할 수 있는 웹기반 악성코드 분석 플랫폼을 제안하고자 한다. AI 탐지 시스템에서 얻은 결과를 시각화 플랫폼을 통해 보여줌으로써, 검사 대상파일이 악성일 가능성이 얼마나 되는지 확인하고 분석가에게 분석의 필요성 및우선순위를 설정하는 데 도움을 줄 수 있다. 사전 학습된 모델을 통해 파일의외부 유출 없이 검사 결과를 확인하는 것이 가능하며, 필요에 따라 AI 탐지모델을 변경 및 추가할 수 있기 때문에 악성코드 분석 플랫폼의 활용도는 높을것으로 예상된다.
Abstract
AI-based malware analysis is a method for analyzing and detecting numerous variants and new types of malware that were not detected by existing pattern-based vaccine engines using artificial intelligence technology. AI-based malware analysis and detection technology does not need to pre-define malware patterns, so the vaccine engines can be relatively lightweight. In this paper, we propose a deep learning-based detection system for analyzing and detecting variants and new malwares, and a web-based malware analysis platform that can check the detection results. By showing the results obtained from the AI detection system through a visualization platform, it is possible to determine how likely a file to be scanned is malicious, and to help analysts set the need and priority for analysis. Through the pre-trained model, it is possible to derive the detection result without external leakage of the file, and as the AI detection model can be changed and added as needed, the utility of the malware analysis platform is expected to be high.
참고문헌 (29)
- Linda, O., "Neural network based intrusion detection syst em for critical infrastructures", 2009 international joint conference on neural networks, pp.1827~1834 (2009), IEEE
- Dahl, G. E., "Large-scale malware classification usi ng random projections and neural networks", 2013 IEEE International Conference on Acoustics, Speech and Signal Processing, pp.3422~3426 (2013), IEEE
- Bartos, K., "Optimized invariant representation of network tr affic for detecting unseen malware variants", 25th {USENIX} Security Symposium ({USENIX} Security 16), pp.807~822 (2016)
- Aghakhani, H., "When Malware is Packin'Heat; Limits of Machine Learning Classifier s Based on Static Analysis Features", Network and Distributed Systems Security (ND SS) Symposium 2020 (2020)
- Copty, F., "Accurate malware detection by extreme abstraction", Proceedings of the 34th Annual Computer Security Applications Conference, pp.101~111 (2018)
- He, K., "Deep residual learning for image recognition", Proceedings of the IEEE conference on computer vision and pattern recognition, pp.770~778 (2016)
- Pascanu, R., "Malware cl assification with recurrent networks", 2015 IEEE International Conference on Acoustic s, Speech and Signal Processing (ICASSP), pp.1916~1920 (2015), IEEE
- Saxe, J., "Deep neural network based malware detection using two di mensional binary program features", 2015 10th International Conference on Malicious and Unwanted Software (MALWARE), pp.11~20 (2015), IEEE
- Rudd, E. M., "{ALOHA}: Auxiliary Lo ss Optimization for Hypothesis Augmentation", 28th {USENIX} Security Symposium ({USENIX} Security 19), pp.303~320 (2019)
- "VirusTotal"[URL]
- "Sigcheck"[URL]
- Burnap, P., "Malware classification using self organising feature maps and machine activity data", computers & security, 73, pp.399~410 (2018)
- "Machine Learning at Waikato University"[URL]
- "Recurrent neural network"[URL]
- "Echo state network"[URL]
- "Logistic Regression – Detailed Overview"[URL]
- Nishiyama, T., "SILU: Strategy Involvin g Large-scale Unlabeled Logs for Improving Malware Detector", 2020 IEEE Symposi um on Computers and Communications (ISCC), pp.1~7 (2020), IEEE
- "Machine Learning in Cybersecurity"[URL]
- "Decision Tree Ensembles – Bagging and Boosting"[URL]
- "Smart Whitelisting Using Locality Sensetive Hashing"[URL]
- "Locality-sensitive hashing"[URL]
- "안랩 MDS에 적용된 머신러닝 시스템은 무엇?"[URL]
- "세인트시큐리티, 국내 첫 AI 백신 ‘맥스’국내외 공식 출시"[URL]
- "Saint Security"[URL]
- "Convolutional neural network"[URL]
- "정보보호 R&D 소개"[URL]
- "N-gram"[URL]
- "Opcode"[URL]
- "objdump"[URL]