macOS 운영체제에서 화이트리스트 구축을 위한 신뢰 프로세스 수집 연구

Abstract

Blacklist-based tools are most commonly used to effectively detect suspected malicious processes. The blacklist-based toolcompares the malicious code extracted from the existing malicious code with the malicious code. Therefore, it is mosteffective to detect known malicious codes, but there is a limit to detecting malicious code variants. In order to solve thisproblem, the necessity of a white list-based tool, which is the opposite of black list, has emerged. Whitelist-based tools donot extract features of malicious code processes, but rather collect reliable processes and verify that the process that checksthem is a trusted process. In other words, if malicious code is created using a new vulnerability or if variant malicious codeappears, it is not in the list of trusted processes, so it can effectively detect malicious code. In this paper, we propose amethod for effectively building a whitelist through research that collects reliable processes in the macOS operating system.