Section, DLL feature 기반 악성코드 분석 기술 연구
Malware Analysis Based on Section, DLL
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
기존 악성코드를 기반으로 만들어지는 변종 악성코드들은 약간의 패턴 변화로도 기존 보안체계를 쉽게 회피할 수 있고 제작 과정이 간단하여 널리 사용되고 있다. 이러한 악성코드는 일평균 160만개 이상 출현하고 있고, 사이버 공간 뿐아니라 피해규모가 큰 IoT/ICS로 점차 확대되고 있다. 본 논문에서는 기존에 자주 이용되는 Pattern기반 분석, Sandbox기반 분석, CFG/Strings 기반 분석 등이 아니라, 큰 의미를 부여하지 않았던 PE Section 및 DLL의 특징에 기반한 분석방법을 제안한다. 제안모델을 실제 구축 및 실험결과, 유의미한 탐지율과 오탐율을 기록했으며, 기존의 다양한 분석기술을 복합 운영 시 효과적인 악성코드 대응이 가능할 것으로 기대된다.
Abstract
Malware mutants based on existing malware is widely used because it can easily avoid the existing security system even with a slight pattern change. These malware appear on average more than 1.6 million times a day, and they are gradually expanding to IoT / ICS as well as cyber space, which has a large scale of damage. In this paper, we propose an analytical method based on features of PE Section and DLL that do not give much significance, rather than pattern-based analysis, Sandbox-based analysis, and CFG, Strings-based analysis. It is expected that the proposed model will be able to cope with effective malicious code in case of combined operation of various existing analysis technologies.
참고문헌 (28)
- Syarif Yusirwan S, "Implementation of Malware Analysis using Static and Dynamic Analysis Method", International Journal of Computer Applications, 117(6), pp.11~15 (2015)
- A. Moser, "Limits of Static Analysis for Malware Detection", IEEE, 21, pp.421~430 (2007)[DOI]
- Hiran V. Nath, "Static Malware Analysis Using Machine Learning Methods", SNDS 2014, CCIS 420, pp.440~450 (2014)
- 유성태, "API 통계 기반의 워드 클라우드를 이용한 악성코드 분석 기법", 한국산학기술학회논문지, 16(10), pp.7211~7218 (2015), 한국산학기술학회[DOI]
- Complexity-based Packed Executable Classification with High Accuracy, "Han-young Noh", School of Engineering, 1~35 (2009)
- 권희준, "Multi N-gram을 이용한 악성코드 분류 시스템", 보안공학연구논문지, 9(6), pp.531~542 (2012), 보안공학연구지원센터
- Youngjoon Ki, "A NoveApproach to Detect Malware based on API Call SequenceAnalysis", International Journal of Distributed Sensor Network, pp.9~ (2015)
- Scott Treadwell, "A Heuristic Approach forDetection of Obfuscated Malware", 2009 IEEE. ISI, pp.291~299 (2009)
- R. de Janeiro, "Mohaisen A, Alrawi O (2013) Unveiling zeus: automated classification of malware samples", 22nd international conference on worldwide webcompanion, pp.829~832 (2013), ACM
- Lee, Taejin, "Effective and Reliable Malware Group Classification for a Massive Malware Environment", International Journal of Distributed Sensor Networks (2016)
- A. Sami, "Malware detection based on mining API calls", Proceedings of the 25th Annual ACM Symposium on Applied Computing (SAC ’10), pp.1020~1025 (2010), ACM
- M. K. Shankarapani, "Malware detection using assembly and API call sequences", Journal in Computer Virology, 7(2), pp.107~119 (2011)
- Malware normalization, "M. Christodorescu", University ofWisconsin, ~, pp.EPFL-REPORT 167534 (2005)
- N. Idika, "A survey of malware detection techniques", pp.2007
- Y. Ye, "IMDS : intelligent malware detection system", Proceedings of the 13th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp.1043~1047 (2007)
- Wu. L, "Behavior-based malware analysis and detection", 2011 first international workshop on complexity and data mining (IWCDM), pp.39~42 (2011), IEEE
- Pratiksha N, "Security in computing and communications" (2013), Springer
- 우경문, "통계적 방법을 이용한 웜 전파 모델링", 한국통신학회논문지B, 37(3), pp.212~218 (2012), 한국통신학회
- "Total Malware Statistics"[URL]
- Cyber Threat Intelligence Report, , Mandiant, ~
- "Kaspersky"[URL]
- "CTA(Cyber Threat Alliance)"[URL]
- "CSC(Cyber Security Coalition)"[URL]
- "ACM workshop on Security and artificial intelligence (AISec)", ~
- "Malware Normalization", ~
- Dong-wook Hwang, "A Study on Malicious Activity Automatic Detection based on API calls", Proceedings of Symposium of the Korean Institute of communications and Information Sciences (2016)