Adaptive Boosting을 사용한 패커 식별 방법 연구
Packer Identification Using Adaptive Boosting Algorithm
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
악성코드 분석은 컴퓨터 보안의 중요한 관심사 중 하나로 분석 기법의 진보는 컴퓨터 보안의 중요 사항이 되었다. 기존에는 악성코드를 탐지할 때 Signature-based 방식을 사용하였으나 패킹된 악성코드의 비율이 높아지면서 기존 Signature-based 방식으로는 탐지에 어려움이 많아 졌다. 이에, 본 논문에서는 머신러닝을 사용하여 패킹된프로그램의 패커를 식별하는 방법을 제안한다. 제안한 방법은 패킹된 프로그램을 파싱하여 패커를 특정 지을 수 있는 특정 PE 정보를 추출하고 머신러닝 모델 중 Adaptive Boosting 알고리즘을 사용하여 패커를 식별한다. 제안한 방법의 정확도를 확인하기 위해 12가지 종류의 패커로 패킹된 프로그램 391개를 수집하여 실험하였으며, 약99.2%의 정확도로 패커를 식별하는 것을 알 수 있었다. 또한, Signature-based PE 식별 도구인 PEiD와 기존머신러닝을 사용한 방법으로 식별한 결과를 제시하였으며, 본 논문에서 제안한 방법이 기존의 방법보다 패커를 식별하는데 정확도와 속도면에서 더 뛰어난 성능을 발휘하는 것을 알 수 있다.
Abstract
Malware analysis is one of the important concerns of computer security, and advances in analysis techniques havebecome important for computer security. In the past, the signature-based method was used to detect malware. However, asthe percentage of packed malware increased, it became more difficult to detect using the conventional method. In this paper,we propose a method for identifying packers of packed programs using machine learning. The proposed method parses thepacked program to extract specific PE information that can identify the packer and identifies the packer using the AdaptiveBoosting algorithm among the machine learning models. To verify the accuracy of the proposed method, we collected andtested 391 programs packed with 12 types of packers and found that the packers were identified with an accuracy of about99.2%. In addition, we presented the results of identification using PEiD, a signature-based PE identification tool, andexisting machine learning method. The proposed method shows better performance in terms of accuracy and speed inidentifying packers than existing methods.
참고문헌 (18)
- "detection packed malware" (2019)[URL]
- T. Brosch, "Runtime packers: The hidden problem", Black Hat USA, ~ (2006)
- R. Isawa, "An original entry point detection method with candidate-sorting for more effective generic unpacking", IEICE TRANSACTIONS on Information and Systems, E98-D(4), pp.883~893 (2015)
- S. D'ALESSIO, "PinDemonium: a DBI- based generic unpacker for Windows executables", Black hat, ~ (2016)
- Kim Gyeong-Min, "Efficient Automatic Original Entry Point Detection", Journal of Information Science & Engineering, 35(4), pp.887~902 (2019)
- "Tuts4You" (2019)[URL]
- "VIRUSTOTAL" (2019)[URL]
- "peid" (2019)[URL]
- B. Jung, "Packer identification method based on byte sequences", Concurrency and Computation: Practice and Experience, 32(8), pp.e5082~ (2018)
- N.M. Hai, "Packer identification based on metadata signature", Proceedings of the 7th Software Security, Protection, and Reverse Engineering, 2017, 1~11
- "BE-PUM" (2019)[URL]
- S. Naval, "Spade: Signature based packer detection", Proceedings of the First International Conference on Security of Internet of Things, pp.96~101 (2012), ACM
- "ollydbg" (2019)[URL]
- T, Ban, "Application of string kernel based support vector machine for malware packer identification", The 2013 International Joint Conference on Neural Networks (IJCNN), pp.1~8 (2013), IEEE
- K. Kancherla, "Packer identification using Byte plot and Markov plot", Journal of Computer Virology and Hacking Techniques, 12(2), pp.101~111 (2016)
- "upx" (2019)[URL]
- "vmprotect" (2019)[URL]
- "sklearn" (2019)[URL]