파워쉘 기반 악성코드에 대한 역난독화 처리와 딥러닝 기반 탐지 방법
Deobfuscation Processing and Deep Learning-Based Detection Method for PowerShell-Based Malware
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
2021년에는 코로나의 여파로 랜섬웨어를 활용한 공격이 유행했으며 그 수는 매년 급증하고 있다. 그 중 파워쉘은 랜섬웨어에 주요 기술로 사용되고 있어 파워쉘 기반 악성코드 탐지 기법의 필요성은 증가하고 있으나 기존의 탐지 기법은 난독화가 적용된 스크립트를 탐지하지 못하거나 역난독화에 시간이 오래 소요되는 한계가 존재한다. 이에 본 논문에서는 간단하고 빠른 역난독화 처리과정, Word2Vec과 CNN(Convolutional Neural Network)으로 구성되어 스크립트의 의미를 학습하고 특징을 추출해 악성 여부를 판단할 수 있는 딥러닝 기반의 분류 모델을 제안한다. 2021 사이버보안 AI/빅데이터 활용 경진대회의 AI 기반 파워쉘 악성 스크립트 탐지 트랙에서 제공된 1400개의 악성코드와 8600개의 정상 스크립트를 이용하여 제안한 모델을 테스트한 결과 기존보다 5.04배 빠른 역난독화 실행 시간, 100%의 역난독화 성공률, 0.01의 FPR(False Positve Rate), 0.965의 TPR(True Positive Rate)로 악성코드를 빠르고 효과적으로 탐지함을 보인다.
Abstract
In 2021, ransomware attacks became popular, and the number is rapidly increasing every year. Since PowerShell is used as the primary ransomware technique, the need for PowerShell-based malware detection is ever increasing. However, the existing detection techniques have limits in that they cannot detect obfuscated scripts or require a long processing time for deobfuscation. This paper proposes a simple and fast deobfuscation method and a deep learning-based classification model that can detect PowerShell-based malware. Our technique is composed of Word2Vec and a convolutional neural network to learn the meaning of a script extracting important features. We tested the proposed model using 1400 malicious codes and 8600 normal scripts provided by the AI-based PowerShell malicious script detection track of the 2021 Cybersecurity AI/Big Data Utilization Contest. Our method achieved 5.04 times faster deobfuscation than the existing methods with a perfect success rate and high detection performance with FPR of 0.01 and TPR of 0.965.
참고문헌 (23)
- Alex Krizhevsky, "ImageNet Classifi cation with Deep Convolutional Neura l Networks", Advances in Neural Infor mation Processing Systems, pp.1106~1114 (2012)
- Peter W. Battaglia, "Relational inductive biases, deep lear ning, and graph networks", arXiv prep rint arXiv : 1806. 01261v3, ~ (2018)
- Tomas Mikolov, "Efficient Estim ation of Word Representations in Vect or Space", arXiv preprint arXiv : 1301. 3781v3, ~ (2013)
- D. Hendler, "D etecting malicious powershell comman ds using deep neural networks", Proce edings of the 2018 on Asia Conference on Computer and Communications Sec urity, pp.187~197 (2018)
- G. Rusak, "AST-Based Deep Learning for Detecting Malicious PowerShell", Proc eedings of the 2018 ACM SIGSAC Con ference on Computer and Communicat ions Security, pp.2276~2278 (2018)
- D. Hendler, "A MSI-Based Detection of Malicious Po werShell Code Using Contextual Emb eddings", Proceedings of the 15th AC M Asia Conference on Computer and Communications Security, pp.679~693 (2020)
- "Ransomware attackers do wn shift to ‘Mid-Game’ hunting in Q32021"[URL]
- "2021 Ransomware Special R eport"[URL]
- "McAfee Labs COVID-19 Thre ats Report"[URL]
- "Antimalware scan interfa ce"[URL]
- C. Liu, "PS DEM: A Feasible De-Obfuscation Met hod for Malicious PowerShell Detectio n", 2018 IEEE Symposium on Comput ers and Communications, pp.825~831 (2018)
- M. AbdelKhalek, "JSD ES : An Automated De-Obfuscation Sy stem for Malicious JavaScript", Procee dings of the 12th International Confer ence on Availability, Reliability and S ecurity, pp.1~13 (2017)
- "PSDecode"[URL]
- V. Nair, "Rectified linear units improve restricted boltzma nn machines", Proceedings of the 27th international conference on machine l earning, pp.807~814 (2010)
- D. P. Kingma, "Adam : a method for stochastic optimization", arXiv preprint arXiv:1412.6980v9, ~ (2017)
- Tomas Mikolov, "Distributed Representations of Words and Phrases and their Compositionali ty", Advances in Neural Information P rocessing Systems, pp.3111~3119 (2013)
- Dumitru Erhan, "W hy Does Unsupervised Pre-training H elp Deep Learning?", Journal of Machi ne Learning Research, pp.625~660 (2010)
- "about_Parsing"[URL]
- C. Szegedy, "Going deeper with convolutions", IEE E Conference on Computer Vision and Pattern Recognition, pp.1~9 (2015)
- R. Collobert, "Natural language processing(almost)from scratch", Journal of Ma chine Learning Research, 12(76), pp.2493~2537 (2011)
- Y. Kim, "Convolutional neural networ ks for sentence classification", Proceed ings of the 2014 Conference on Empiri cal Methods in Natural Language Pro cessing, pp.1746~1751 (2014)
- "Cyber security AI/bigdata chall enge 2021"[URL]
- "McAfee Labs Threats Report"[URL]