코드패치 및 하이브리드 분석 환경을 활용한 악성코드 데이터셋 추출 프레임워크 설계
Framework Design for Malware Dataset Extraction Using Code Patches in a Hybrid Analysis Environment
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
악성코드는 금전적인 목적에 의하여 서비스의 한 형태로 블랙마켓에 판매되고 있다. 판매에 따른 수요가 증가함에 따라 악성코드를 통한 공격이 확장되었다. 이에 대응하기 위해 인공지능을 활용한 탐지 및 분류 연구들이 등장하였지만, 공격자들은 분석을 방지하고자 다양한 안티 분석기술을 악성코드에 적용하고 있다. 본 논문에서는 안티 분석기술이 적용된 악성코드들로부터 데이터셋을 확보하기 위해 하이브리드형 바이너리 분석 프레임워크 Malware Analysis with Dynamic Extraction(MADE)을 제안한다. MADE 프레임워크는 Anti-VM, Anti-Debugging이 적재된 바이너리를 포함하여 자동화된 동적 분석을 수행할 수 있다. MADE 프레임워크는 Anti-Analysis 기술이 적용된 다양한 악성코드들에 대해 90% 이상 우회가 가능하며, API 호출 정보를 포함한 데이터셋 추출이 가능함을 실험을 통해 검증하였다.
Abstract
Malware is being commercialized and sold on the black market, primarily driven by financial incentives. With the increasing demand driven by these sales, the scope of attacks via malware has expanded. In response, there has been a surge in research efforts leveraging artificial intelligence for detection and classification. However, adversaries are integrating various anti-analysis techniques into their malware to thwart analytical efforts. In this study, we introduce the "Malware Analysis with Dynamic Extraction (MADE)" framework, a hybrid binary analysis tool devised to procure datasets from advanced malware incorporating Anti-Analysis techniques. The MADE framework has the proficiency to autonomously execute dynamic analysis on binaries, encompassing those laden with Anti-VM and Anti-Debugging defenses. Experimental results substantiate that the MADE framework can effectively circumvent over 90% of diverse malware implementations using Anti-Analysis techniques and can adeptly extract relevant datasets.
참고문헌 (23)
- Ki-woon Moon, "The latest ransomware trends and developments", Journal of the Korea Institute of Information Security &Cryptology, 32(3), pp.33~39 (2022)
- Singh, Jagsir, "A survey on machine learning-based malware detection in executable files", Journal of Systems Architecture, 112, pp.101861~ (2021)
- Boydell, B. Mac, "Deep learning at the shallow end :Malware classification for non-domain experts", Digital Investigation, 26, pp.S118~S126 (2018)
- Muralidharan, Trivikram, "File Packing from the Malware Perspective : Techniques, Analysis Approaches, and Directions for Enhancements", ACM Computing Surveys, 55(5), pp.1~45 (2022)
- "Cuckoo Sandbox"[URL]
- "Joe Sandbox"[URL]
- Branco, Rodrigo Rubira, "Scientific but not academical overview of malware anti-debugging, anti-disassembly and anti-vm technologies", Black Hat, 1, pp.1~27 (2012)
- Young Bi Lee, "Bypassing anti-analysis of commercial protector methods using DBI tools", IEEE Access, 9, pp.7655~7673 (2021)
- Kirat, Dhilung, "Barebox:efficient malware analysis on bare-metal", Proceedings of the 27th Annual Computer Security Applications, pp.403~412 (2011)
- Saad, Muhammad, "The Study of the Anti-Debugging Techniques and their Mitigations", International Journal for Electronic Crime Investigation, 6(3), pp.33~44 (2022)
- Rakotondravony, Noëlle, "Visualizing and controlling vmi-based malware analysis in iaas cloud", IEEE 35th Symposium on Reliable Distributed Systems, pp.211~212 (2016)
- Taubmann, Benjamin, "Secure Architecture for VMI-based Dynamic Malware Analysis in the Cloud", Fast Abstract in the 46th Annual IEEE, 2016, ~
- Taubmann, Benjamin, "Towards hypervisor support for enhancing the performance of virtual machine introspection", Distributed Applications and Interoperable Systems: 20th IFIP WG 6.1 International Conference, pp.41~54 (2020)
- Oktavianto, Digit, "Cuckoo malware analysis" (2013), Packt Publishing Ltd
- "Volatility" (2007)[URL]
- "OpenStack" (2012)[URL]
- Kominos, Charalampos Gavriil, "Bare-metal, virtual machines and containers in OpenStack", 2017 20th conference on innovations in clouds, internet and networks, pp.36~43 (2017)
- "Malwarebazaar"[URL]
- "MITRE ATT&CK®"[URL]
- Barham, Paul, "Xen and the art of virtualization", ACM SIGOPS operating systems review, 37(5), pp.164~177 (2003)
- Kivity, Avi, "kvm : the Linux virtual machine monitor", Proceedings of the Linux symposium, 1(8), pp.225~230 (2006)
- Bellard, "QEMU, a fast and portable dynamic translator", USENIX annual technical conference, pp.10~5555 (2005)