머신러닝 기반 악성 URL 탐지 기법
Machine Learning-Based Malicious URL Detection Technique
0
조회
0
다운로드
5
인용
0
참고문헌
키워드
초록
최근 사이버 공격은 지능적이고 고도화된 악성코드를 활용한 해킹 기법을 활용하여 재택근무 및 원격의료, 자동산업설비를 공격하고 있어서 피해 규모가 커지고 있다. 안티바이러스와 같은 전통적인 정보보호체계는 시그니처 패턴 기반의 알려진 악성 URL을 탐지하는 방식이어서 알려지지 않은 악성 URL을 탐지할 수 없다. 그리고 종래의 정적분석 기반의 악성 URL 분석 방식은 동적 로드와 암호화 공격에 취약하다. 본 연구에서는 악성 URL 데이터를 동적으로 학습하여 효율적으로 악성 URL 탐지하는 기법을 제안한다. 제안한 탐지 기법에서는 머신러닝 기반의 특징 선택 알고리즘을 사용해 악성 코드를 분류했고, 가중 유클리드 거리(Weighted Euclidean Distance, WED)를 활용하여 사전처리를 진행한 후 난독화 요소를 제거하여 정확도를 개선한다. 실험 결과에 따르면 본 연구에서 제안한 머신러닝 기반 악성 URL 탐지 기법은 종래의 방법 대비 2.82% 향상된 89.17%의 정확도를 보인다.
Abstract
Recently, cyberattacks are using hacking techniques utilizing intelligent and advanced malicious codes for non-face-to-face environments such as telecommuting, telemedicine, and automatic industrial facilities, and the damage is increasing. Traditional information protection systems, such as anti-virus, are a method of detecting known malicious URLs based on signature patterns, so unknown malicious URLs cannot be detected. In addition, the conventional static analysis-based malicious URL detection method is vulnerable to dynamic loading and cryptographic attacks. This study proposes a technique for efficiently detecting malicious URLs by dynamically learning malicious URL data. In the proposed detection technique, malicious codes are classified using machine learning-based feature selection algorithms, and the accuracy is improved by removing obfuscation elements after preprocessing using Weighted Euclidean Distance(WED). According to the experimental results, the proposed machine learning-based malicious URL detection technique shows an accuracy of 89.17%, which is improved by 2.82% compared to the conventional method.
참고문헌 (21)
- Nisar, K., "Ransomware Dissemination and Mitigation Techniques-A Review", The 7th International Conference on Next Generation Computing 2021, pp.173~177 (2021)
- N. Caporusso, "A game-theoretical model of ransomware", International Conference on Applied Human Factors and Ergonomics, pp.69~78 (2018)
- C. Bansal, "Studying ransomware attacks using web search logs", Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval, pp.1517~1520 (2020)
- Ömer Aslan Aslan, "A Comprehensive Review on Malware Detection Approaches", IEEE Access, 8, pp.6249~6271 (2020)
- David S. Wall, "The Transnational Cybercrime Extortion Landscape and the Pandemic : changes in ransomware offender tactics, attack scalability and the organisation of offending", European Law Enforcement Research Bulletin SCE, 5, pp.45~60 (2021)
- Report on the detection trend of malicious code hidden sites in the second half of 2019, "Korea Internet & Security Agency", ~ (2020)
- Report on the detection trend of malicious code hidden sites in the first half of 2020, "Korea Internet & Security Agency", ~ (2020)
- Report on the detection trend of malicious code hidden sites in the second half of 2020, "Korea Internet & Security Agency", ~ (2021)
- Report on the detection trend of malicious code hidden sites in the first half of 2021, "Korea Internet & Security Agency", ~ (2021)
- P. Prakash, "PhishNet:Predictive Blacklisting to Detect Phishing Attacks", 2010 Proceedings IEEE INFOCOM, pp.1~5 (2010)
- B. Sun, "AutoBLG:Automatic URL blacklist generator using search space expansion and filters", 2015 IEEE Symposium on Computers and Communication (ISCC), pp.625~631 (2015)
- 장혜영, "악성 URL 탐지 및 필터링 시스템 구현", 정보과학회 컴퓨팅의 실제 논문지, 16(4), pp.405~414 (2010), 한국정보과학회
- Z. Zuo, "BigSpa:An Efficient Interprocedural Static Analysis Engine in the Cloud", 2019IEEE International Parallel and Distributed Processing Symposium (IPDPS), pp.771~780 (2019)
- Y. Wu, "HomDroid : detecting Android covert malware by social-network homophily analysis", Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, pp.216~229 (2021)
- Jinrong Bai, "Malware Detection Method based on Dynamic Variable Length API Sequence", 201912th International Symposium on Computational Intelligence and Design (ISCID), pp.285~288 (2019)
- 최양서, "악성프로그램 탐지를 위한 PE헤더 특성 분석 기술", 융합보안 논문지, 8(2), pp.63~70 (2008), 한국융합보안학회
- D. Ugarte, "PowerDrive : Accurate de-obfuscation and analysis of powershell malware", International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, pp.240~259 (2019)
- 송지현, "Evaluations of AI‐based malicious PowerShell detection with feature optimizations", ETRI Journal, 43(3), pp.549~560 (2021), 한국전자통신연구원[DOI]
- Carolyn J. Holz, "Investigating representations of obfuscated malicious PowerShell", Ph.D., pp.2019
- Giuseppe Mario Malandrone, "PowerDecode: a PowerShell Script Decoder Dedicated to Malware Analysis", Proceedings of the Italian Conference on Cybersecurity 2021, pp.219~232 (2021)
- Pengtao Zhang, "Class-wise information gain", 2013 IEEE Third International Conference on Information Science and Technology (ICIST), pp.972~978 (2013)