서바이벌 네트워크 개념을 이용한 저자 식별 프레임워크: 의미론적 특징과 특징 허용 범위
Authorship Atribution Framework Using Survial Network Concept : Semantic Features and Tolerances
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
악성코드 저자 식별은 알려진 악성코드 저자의 특징을 이용하여 알려지 않은 악성코드의 저자 특징과 비교를통해 악성코드를 식별하기 위한 연구 분야이다. 바이너리를 이용한 저자 식별 방법은 실질적으로 배포된 악성코드를대상으로 수집 및 분석이 용이하다는 장점을 갖으나, 소스코드를 이용한 방법보다 특징 활용 범위가 제한된다. 이러한 한계점으로 인해 다수의 저자를 대상으로 정확도가 저하된다는 단점을 갖는다. 본 연구는 바이너리 저자 식별에한계점을 보완하기 위하여 ‘바이너리로부터 의미론적 특징 정의’와 ‘서바이벌 네트워크 개념을 이용한 중복 특징에 대한 허용 범위 정의’ 방법을 제안한다. 제안한 방법은 바이너리 정보로부터 Opcode 기반의 그래프 특징을 정의하며,서바이벌 네트워크 개념을 이용하여 저자별 고유 특징을 선택할 수 있는 허용범위를 정의하는 것이다. 이를 통해 저자별 특징 정의 및 특징 선택 방법을 하나의 기술로 정의할 수 있으며, 실험을 통해 선행연구보다 5.0%의 정확도향상과 함께 소스코드 기반 분석과 동일한 수준의 정확도 도출이 가능함을 확인할 수 있었다.
Abstract
Malware Authorship Attribution is a research field for identifying malware by comparing the author characteristics of unknown malware with the characteristics of known malware authors. The authorship attribution method using binaries has the advantage that it is easy to collect and analyze targeted malicious codes, but the scope of using features is limited compared to the method using source code. This limitation has the disadvantage that accuracy decreases for a large number of authors. This study proposes a method of ‘Defining semantic features from binaries’ and ‘Defining allowable ranges for redundant features using the concept of survival network’ to complement the limitations in the identification of binary authors. The proposed method defines Opcode-based graph features from binary information, and defines the allowable range for selecting unique features for each author using the concept of a survival network. Through this, it was possible to define the feature definition and feature selection method for each author as a single technology, and through the experiment, it was confirmed that it was possible to derive the same level of accuracy as the source code-based analysis with an improvement of 5.0% accuracy compared to the previous study.
참고문헌 (14)
- D. I. Holmes, "Authorship Attribution", Computers and the Humanities, 28(2), pp.87~106 (1994)
- S. Alrabaee, "On the Feasibility of Malware Authorship Attribution", International Symposium on Foundations and Practice of Security, pp.256~272 (2017), Springer
- E. Stamatatos, "A survey of modern authorship attribution methods", Journal of the American Society for information Science and Technology, 60(3), pp.538~556 (2009)
- Q. Zhang, "MetaAware:Identifying Metamorphic Malware", Twenty-Third Annual Computer Security Applications Conference IEEE, pp.411~420 (2007)
- B. Kang, "PageRank in Malware Categorization", Proceedings of the 2015 Conference on research in adaptive and convergent systems, pp.291~295 (2015)
- A. Caliskan-Islam, "De-anonymizing Program -mers via Code Stylometry", 24th USENIX Security Symposium Security, 15, pp.255~270 (2015)
- Y. Ye, "A survey on malware detection using data mining techniqu-es", ACM Computing Surveys CSUR, 50(2), pp.1~41 (2017)
- 김수정, "정적 분석 기반 기계학습 기법을 활용한 악성코드 식별 시스템 연구", 정보보호학회논문지, 29(4), pp.775~784 (2019), 한국정보보호학회[DOI]
- D. Canali, "A Quantitative Study of Accuracy in System Call-Based Malware Detec -tion", Proceedings of the 2012International Symposium on Software Testing and Analysis, pp.122~132 (2012)
- M. Christodorscu, "Mining specifications of malicious behavior", Proceedings of the the 6th joint meeting of the European software engineering conference and the ACM SIGSOFT symposium on The foundations of software engineering, pp.5~14 (2007)
- A. Saadatpour, "Dynamical and Structural Analysis of a T Cell Survival Network Identifies Novel Candidate Thera -peutic Targets for Large Granular Lymphocyte Leukemia", PLoS computa -tional biology, 7(11), pp.1~15 (2011)
- V. Q. Marinho, "Authorship Attribution via network motifs identification", Proceedings of 5th Brazilian Conference on Intelligent Systems, pp.355~360 (2016)
- Applying Supervised Learning on Malware Authorship Attribution, "B. Coen", Digital Security Group Institute for Computing and Information Sciences, Radboud University Nijmegen, 1~85 (2019)
- S. Han, "Parameter selection in SVM with RBF kernel function", Proceedings of World Automation Congress, pp.1~4 (2012)