Opcode 빈도수 기반 악성코드 이미지를 활용한 CNN 기반 악성코드 탐지 기법
CNN-Based Malware Detection Using Opcode Frequency-Based Image
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
인터넷이 발달하고 컴퓨터 이용률이 높아짐에 따라 악성코드로 인한 위협 또한 함께 증가하고 있다. 매년 발견되는 악성코드의 수는 급격히 증가하여 자동으로 대량의 악성코드를 분석하기 위한 시스템이 필요한 상황이다. 본 논문에서는 딥러닝 알고리즘을 활용한 악성코드 자동 분석 기법을 소개한다. CNN(Convolutional Neural Network)라는 이미지 분류에 활용도가 높은 알고리즘을 이용하여 악성코드의 특징을 이미지화한 데이터를 분석한다. 제안하는 방법은 악성코드의 Semantic한 정보를 탐지에 활용하기 위하여 단순 바이너리 바이트를 기반으로 생성한 이미지가 아닌, 바이너리의 명령어 빈도수를 기반으로 생성한 이미지를 CNN으로 분석한다. 악성코드 10,000개 정상코드 10,000개로 구성된 대량의 데이터 셋을 활용하여 탐지 성능을 확인한 결과, 제안하는 방법은 91%의 정확도로 악성코드를 탐지할 수 있음이 확인되었다.
Abstract
As the Internet develops and the utilization rate of computers increases, the threats posed by malware keep increasing. This leads to the demand for a system to automatically analyzes a large amount of malware. In this paper, an automatic malware analysis technique using a deep learning algorithm is introduced. Our proposed method uses CNN (Convolutional Neural Network) to analyze the malicious features represented as images. To reflect semantic information of malware for detection, our method uses the opcode frequency data of binary for image generation, rather than using bytes of binary. As a result of the experiments using the datasets consisting of 20,000 samples, it was found that the proposed method can detect malicious codes with 91% accuracy.
참고문헌 (29)
- N. Etaher, "From ZeuS to Zitmo : Trends in Banking Malware", IEEE Trustcom, ISPA, pp.2015, 1[DOI]
- Ö. A. Aslan, "A Comprehensive Review on Malware Detection Approaches", IEEE Access, 8, pp.6249~6271 (2020)
- M. Yeo, "Flow-based malware detection using convolutional neural network", International Conference on Information Networking(ICOIN), pp.910~913 (2018)
- S. Tobiyama, "Malware Detection with Deep Neural Network Using Process Behavior", IEEE 40th Annual Computer Software and Applications Conference(COMPSAC), 2, pp.577~582 (2018)
- A. Sharma, "Malware Detection Using 1-Dimensional Convolutional Neural Networks", IEEE European Symposium on Security and Privacy Workshops(EuroS&PW), pp.247~256 (2019)
- Jaemin Jung, "Android malware detection using convolutional neural networks and data section images", Research in Adaptive and Convergent Systems(RACS18), pp.149~153 (2018)
- Jagsir Singh, "A survey on machine learning-based malware detection in executable files", Journal of Systems Architecture, 112 (2021)
- 김희연, "N-gram opcode를 활용한 머신러닝 기반의 분석 방지 보호 기법 탐지 방안 연구", 정보보호학회논문지, 32(2), pp.181~192 (2022), 한국정보보호학회[DOI]
- 전예진, "기계학습 기반 악성코드 검출을 위한 이미지 생성 방법", 정보보호학회논문지, 32(2), pp.381~390 (2022), 한국정보보호학회[DOI]
- Ahmed Bensaoud, "Classifying Malware Images with Convolutional Neural Network Models", Computer Vision and Pattern Recognition, 22(6), pp.1022~1031 (2020)
- T. -Y. Wang, "Detection of packed executables using support vector machines", International Conference on Machine Learning and Cybernetics, 2, pp.717~722 (2011)
- Z. Salehi, "A miner for malware detection based on API function calls and their arguments", Artificial Intelligence and Signal Processing(AISP 2012), pp.563~568 (2012)
- M. Ijaz, "Static and Dynamic Malware Analysis Using Machine Learning", International Bhurban Conference on Applied Sciences and Technology(IBCAST), pp.687~691 (2019)
- Y. Lecun, "Gradient-based learning applied to document recognition", Proceedings of the IEEE, 86(11), pp.2278~2324 (1998)
- S. Wright, "Correlation and Causation", Journal of Agricultural Research, 20, pp.557~585 (1921)
- Frank Nielsen, "Introduction to HPC with MPI for Data Science", pp.195~211 (2016), Springer
- Erich Schubert, "DBSCAN Revisited, Revisited : Why and How You Should(Still)Use DBSCAN", ACM Transactions on Database Systems, 42(3), pp.1~21 (2017)
- "Information Security R&D Introductio n"[URL]
- M. Abadi, "TensorFlow:Large-Scale Machine Learning on Heterogeneous Systems", ~ (2015)
- S. loffe, "Batch Normalization : Accelerating Deep Network Training by Reducing Internal Covariate Shift", Proceedings of Machine Learning Research, 37, pp.448~456 (2015)
- A. Yewale, "Malware detection based on opcode frequency", International Conference on Advanced Communication Control and Computing Technologies(ICACCCT), pp.646~649 (2016)
- Usukhbayar Baldangombo, "A Static Malware Detection System Using Data Mining Methods", International Journal of Artificial Intelligence & Application, (4) (2013)
- S. Naval, "Employing Program Semantics for Malware Detection", IEEE Transactions on Information Forensics and Security, 10(12), pp.2591~2604 (2015)
- R. S. Pirscoveanu, "Analysis of Malware behavior : Type classification using machine learning", International Conference on Cyber Situational Awareness, Data Analytics and Assessment(CyberSA), pp.1~7 (2015)
- Smith Michael, "Dynamic Analysis of Executables to Detect and Characterize Malware", IEEE International Conference on Machine Learning and Applications(ICMLA), pp.16~22 (2018)
- K. Aoki, "Controlling malware HTTP communications in dynamic analysis system using search engine", Third International Workshop on Cyberspace Safety and Security (CSS), pp.1~6 (2011)
- Jun Han, "The influence of the sigmoid function parameters on the speed of backpropagation learning, vol. 930", pp.195~201 (1995), Springer
- Bakhshinejad, "Parallel-CNN network for malware detection", IET Information Security, 14(2), pp.210~219 (2020)
- BinZhang, "Ransomware classification using patch-based CNN and self-attention network on embedded N-grams of opcodes", Future Generation Computer Systems, 110, pp.708~720 (2020)