N-gram opcode를 활용한 머신러닝 기반의 분석 방지 보호 기법 탐지 방안 연구
A Study on Machine Learning Based Anti-Analysis Technique Detection Using N-gram Opcode
2
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
신종 악성코드의 등장은 기존 시그니처 기반의 악성코드 탐지 기법들을 무력화시키며 여러 분석 방지 보호 기법들을 활용하여 분석가들의 분석을 어렵게 하고 있다. 시그니처 기반의 기존 연구는 악성코드 제작자가 쉽게 우회할 수 있는 한계점을 지닌다. 따라서 본 연구에서는 악성코드 자체의 특성이 아닌, 악성코드에 적용될 수 있는 패커의 특성을 활용하여, 단시간 내에 악성코드에 적용된 패커의 분석 방지 보호 기법을 탐지하고 분류해낼 수 있는 머신러닝 모델을 구축하고자 한다. 본 연구에서는 패커의 분석 방지 보호 기법을 적용한 악성코드 바이너리를 대상으로 n-gram opcode를 추출하여 TF-IDF를 활용함으로써 피처(feature)를 추출하고 이를 통해 각 분석 방지 보호 기법을 탐지하고 분류해내는 머신러닝 모델 구축 방법을 제안한다. 본 연구에서는 실제 악성코드를 대상으로 악성코드 패킹에 많이 사용되는 상용 패커인 Themida와 VMProtect로 각각 분석 방지 보호 기법을 적용시켜 데이터셋을 구축한 뒤, 6개의 머신러닝 모델로 실험을 진행하였고, Themida에 대해서는 81.25%의 정확도를, VMProtect에 대해서는 95.65%의 정확도를 보여주는 최적의 모델을 구축하였다.
Abstract
The emergence of new malware is incapacitating existing signature-based malware detection techniques., and applying various anti-analysis techniques makes it difficult to analyze. Recent studies related to signature-based malware detection have limitations in that malware creators can easily bypass them. Therefore, in this study, we try to build a machine learning model that can detect and classify the anti-analysis techniques of packers applied to malware, not using the characteristics of the malware itself. In this study, the n-gram opcodes are extracted from the malicious binary to which various anti-analysis techniques of the commercial packers are applied, and the features are extracted by using TF-IDF, and through this, each anti-analysis technique is detected and classified. In this study, real-world malware samples packed using Themida and VMProtect with multiple anti-analysis techniques were trained and tested with 6 machine learning models, and it constructed the optimal model showing 81.25% accuracy for Themida and 95.65% accuracy for VMProtect.
참고문헌 (25)
- "Malware Statistics & Trends Report |AV-TEST, Total malware"[URL]
- 조우진, "API 호출 빈도를 이용한 악성코드 패밀리 탐지 및 분류 방법", 정보보호학회논문지, 31(4), pp.605~616 (2021), 한국정보보호학회[DOI]
- Brand M, "Mal ware forensics: Discovery of the inten t of deception", Journal of Digital Forensics, Security and Law, 5(4), pp.1~13 (2010)
- Barbosa, Gabriel Negreira, "Prevalent characte ristics in modern malware", Black Hat USA Conference, pp.1~72 (2014)
- Branco, Rodrigo Rubira, "Scientific but not academical overvie w of malware anti-debugging, anti-dis assembly and anti-vm technologies", B lack Hat USA Conference, pp.1~27 (2012)
- Chen, Ping, "Advanced or not? A comparative study of the use of ant i-debugging and anti-VM techniques i n generic and targeted malware", IFIP International Conference on ICT Syste ms Security and Privacy Protection, 471, pp.323~336 (2016)
- Oyama, Yoshihiro, "Trends of anti-ana lysis operations of malwares observed in API call logs", Journal of Computer Virology and Hacking Techniques, 14(1), pp.69~85 (2018)
- Lee, Young Bi, "Bypassing Anti-Analys is of Commercial Protector Methods U sing DBI Tools", IEEE Access, 9, pp.7655~7673 (2021)
- "Virus Total Online"[URL]
- Pechaz, Bassir, "Malware detectio n using hidden Markov model based o n Markov blanket feature selection m ethod", International Congress on Tec hnology, Communication and Knowled ge (ICTCK), pp.558~563 (2015)
- Hansen, Steven Strandlund, "A n approach for detection and family cl assification of malware based on beha vioral analysis", International confere nce on computing, networking and co mmunications (ICNC), pp.1~5 (2016), IEEE
- Kwon, Iltaek, "Extra cting the representative API call patt erns of malware families using recurr ent neural network", Proceedings of th e International Conference on Researc h in Adaptive and Convergent System s, pp.202~207 (2017)
- Raff, Edward, "An investigation of byte n-gram features for malware c lassification", Journal of Computer Vir ology and Hacking Techniques, 14(1), pp.1~20 (2018)
- Aghakhani, Hojjat, "When Malw are is Packin'Heat; Limits of Machine Learning Classifiers Based on Static Analysis Features", Network and Dist ributed Systems Security (NDSS) Sy mposium, pp.1~20 (2020)
- Zhang, Hanqi, "Classification of ransomware families with machine lea rning based on N-gram of opcodes", Future Generation Computer Systems, 90, pp.211~221 (2019)
- Park, Leo Hyun, "Birds of a Fe ature : Intrafamily Clustering for Vers ion Identification of Packed Malware", IEEE Systems Journal vol, 14(3), pp.4545~4556 (2020)
- Cesare, Silvio, "Malwise—an effective and efficient classification system for packed and polymorphic malware", IEEE Tran sactions on Computers, 62(6), pp.1193~1206 (2013)
- Roundy, Kevin A., "Binary-code obfuscations in preva lent packer tools", ACM Computing S urveys(CSUR), 46(1), pp.1~32 (2013)
- Ali, Muhammad, "MALGRA : Ma chine Learning and N-Gram Malware Feature Extraction and Detection Sys tem", Electronics, 9(11), pp.1~21 (2020)
- Moskovitch, Robert, "Unknown malcode detection using opcode repres entation", European conference on int elligence and security informatics, 5376, pp.204~215 (2008)
- "Pin 3.7 User Guide, Pin Documentati on"[URL]
- "Themida Download and Us age"[URL]
- "Malware Download S ite"[URL]
- "Cuckoo Sandbox Do wnload"[URL]
- "Code Virtualizer Do wnload"[URL]