엔트로피 시계열 데이터 추출과 순환 신경망을 이용한IoT 악성코드 탐지와 패밀리 분류
IoT Malware Detection and Family Classification Using Entropy Time Series Data Extraction and Recurrent Neural Networks
1
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
IoT (Internet of Things) 장치는 취약한 아이디/비밀번호 사용, 인증되지 않은 펌웨어 업데이트 등 많은 보안 취약점을 보여 악성코드의 공격대상이 되고 있다. 그러나 CPU 구조의 다양성으로 인해 악성코드 분석 환경 설정과 특징 설계에 어려움이 있다. 본 논문에서는 CPU 구조와 독립된악성코드의 특징 표현을 위해 실행 파일의 바이트 순서를 이용한 시계열 특징을 설계하고 순환 신경망을 통해 분석한다. 제안하는 특징은 바이트순서의 부분 엔트로피 계산과 선형 보간을 통한 고정 길이의 시계열 패턴이다. 추출된 특징의 시계열 변화는 RNN과 LSTM으로 학습시켜 분석한다. 실험에서 IoT 악성코드 탐지는 높은 성능을 보였지만, 패밀리 분류는 비교적 성능이 낮았다. 악성코드 패밀리별 엔트로피 패턴을 시각화하여 비교했을 때 Tsunami와 Gafgyt 패밀리가 유사한 패턴을 나타내 분류 성능이 낮아진 것으로 분석되었다. 제안된 악성코드 특징의 데이터 간 시계열 변화학습에 RNN보다 LSTM이 더 적합하다.
Abstract
IoT (Internet of Things) devices are being attacked by malware due to many security vulnerabilities, such as the use of weakIDs/passwords and unauthenticated firmware updates. However, due to the diversity of CPU architectures, it is difficult to set up a malwareanalysis environment and design features. In this paper, we design time series features using the byte sequence of executable files torepresent independent features of CPU architectures, and analyze them using recurrent neural networks. The proposed feature is afixed-length time series pattern extracted from the byte sequence by calculating partial entropy and applying linear interpolation. Temporary changes in the extracted feature are analyzed by RNN and LSTM. In the experiment, the IoT malware detection showed highperformance, while low performance was analyzed in the malware family classification. When the entropy patterns for each malwarefamily were compared visually, the Tsunami and Gafgyt families showed similar patterns, resulting in low performance. LSTM is moresuitable than RNN for learning temporal changes in the proposed malware features.
참고문헌 (19)
- A. S. Gillis, "What is IoT(Internet of Things)and how does it work", IoT Agenda, TechTarget, 11 (2020)
- Statista, "Number of Internet of Things (IoT) connected devices worldwide from 2019 to 2030", ~ (2020)
- M. B. Barcena, "Insecurity in the internet of things" (2015), Security Response, Symantec
- N. Woolf, "DDoS attack that disrupted internet was largest of its kind in history, experts say", The Guardian, 26, ~ (2016)
- "Mirai Source Code"[URL]
- Mirai variant malware analysis report, "AhnLab", ASEC, ~, pp.ASEC Report, Vol.100 (2020)
- Y. Ye, "A survey on malware detection using data mining techniques", ACM Computing Surveys(CSUR), 50(3), pp.1~40 (2017)
- E. Cozzi, "Understanding linux malware", 2018 IEEE Symposium on Security and Privacy (SP) (2018)
- R. Sihwail, "A survey on malware analysis techniques : Static, dynamic, hybrid and memory analysis", International Journal on Advanced Science, Engineering and Information Technology, Vol. 8, No. 4-2, pp, 8(4-2), pp.1662~1671 (2018)
- T. L. Wan, "Efficient detection and classification of internet-of-things malware based on byte sequences from executable files", IEEE Open Journal of the Computer Society, 1, pp.262~275 (2020)
- H. Darabian, "An opcode-based technique for polymorphic Internet of Things malware detection", Concurrency and Computation Practice and Experience, 32(6), pp.e5173~ (2019)
- I. Miliaraki, "Mind the gap : Large-scale frequent sequence mining", Proceedings of the 2013 ACM SIGMOD International Conference on Management of Data (2013), ACM
- J. Jeon, "Dynamic analysis for IoT malware detection with convolution neural network model", IEEE Access, 8, pp.96899~96911 (2020)
- M. D. Zeiler, "Visualizing and understanding convolution networks", European Conference on Computer Vision (2014), Springer
- R. Lyda, "Using entropy analysis to find encrpyted and packed malware", IEEE Security & Privacy, 5(2), pp.40~45 (2007)
- I. Sorokin, "Comparing files using structural entropy", Journal in Computer Virology, 7(4), pp.259~265 (2011)
- S. Goki, "Deep learning from scratch 2" (2019), Oreilly
- "Malwares.com"[URL]
- "Kaspersky"[URL]