동적 악성코드 분석 시스템 효율성 향상을 위한 사전 필터링 요소 연구
Study of Pre-Filtering Factor for Effectively Improving Dynamic Malware Analysis System
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
인터넷과 컴퓨터의 발달로 인해 신종 변종 악성코드가 하루에 약 1백만 개씩 출현하고 있다. 더욱이 기업을 대상으로하는 표적공격의 경우 알려지지 않은 악성코드를 통해 공격이 진행되므로 전통적인 시그니처에 의한 탐지 방법은 대응에 대한 효율성이 낮게 되어 많은 기업들은 새로운 샌드박스와 같은 동적 분석 시스템을 도입하였다. 그러나 실행 파일뿐만 아니라 워드문서 또는 PDF 형태의 악성코드도 지속적으로 증가하고 있으며 새로운 악성코드 또한 동적 분석 시스템을 우회하는 기술을 포함하고 있어 효율적인 운영을 위해 많은 자원이 필요하고 새로운 기술이 필요하게 되었다. 본 연구에서는 효율적인 동적 분석 시스템을 위해 사전 필터링 기술을 사용하여 효율성을 향상시키기 위한 사전 필터링기술 선정 요소를 도출하고 기술 도입 시 합리적인 선택을 할 수 있도록 AHP(Analytics Hierarchy Process)를 사용하여 의사 결정 모델을 제시하고, 도입 시 활용할 수 있도록 공식을 제시하고 검증하였다.
Abstract
Due to the Internet and computing capability, new and variant malware are discovered around 1 Million per day. Companies use dynamic analysis such as behavior analysis on virtual machines for unknown malware detection because attackers use unknown malware which is not detected by signature based AV effectively. But growing number of malware types are not only PE(Portable Executable) but also non-PE such as MS word or PDF therefore dynamic analysis must need more resources and computing powers to improve detection effectiveness. This study elicits the pre-filtering system evaluation factor to improve effective dynamic malware analysis system and presents and verifies the decision making model and the formula for solution selection using AHP(Analytics Hierarchy Process)
참고문헌 (32)
- "Internet Security Threat Report" (2017)[URL]
- "Missed Alarms and 40 Million Stolen Credit Card Numbe rs: How Target Blew It" (2014)[URL]
- "Threats to Virutal Environ ments" (2015)[URL]
- Saaty T. L., "The Analytic Hierchy Process" (1980), McGraw-Hill
- Chun-Chn Wei, "An AHP-Based approach to ERP System Selection", pp.47~62 (2004), Elsevier
- An analytics hierarchy process(AHP)approach to selection of implementation mode of mobile office system, "Shin-Pil Shin", Seoul National University of Science and Technology, ~ (2013)
- Gorecki, Christian, "Trumanbox:Improving dynamic malware analysis by emulating the internet", Symposium on Self-Stabilizing Systems (2011), Springer Berlin Heidelberg
- Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains, "Eric M. Hutchins", Leading Issues in information Warfare & Security Research, ~ (2011)
- Moshchuk, Alexander, "A Crawler-based Study of Spyware in the Web", NDSS, 1 (2006)
- Pareek, Himanshu, "Application whitelisting:approaches and challenges", International Journal of Computer Science, Engineering and Information Technology (IJCSEIT), 2(5) (2012)
- Chen, Xu, "Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware", Dependable Systems and Networks With FTCS and DCC, 2008. DSN 2008. IEEE International Conference on (2008), IEEE
- Bayer, Ulrich, "Dynamic analysis of malicious code", Journal in Computer Virology, 2(1), pp.67~77 (2006)
- Bayer, Ulrich, "Improving the efficiency of dynamic malware analysis", Proceedings of the 2010 ACM Symposium on Applied Computing (2010), ACM
- Egele, Manuel, "A survey on automated dynamic malware-analysis techniques and tools", Computing Surveys, 44(2), pp.6~ (2012)
- Rieck, Konrad, "Automatic analysis of malware behavior using machine learning", Journal of Computer Security, 19(4), pp.639~668 (2011)
- Dinaburg, Artem, "Ether: malware analysis via hardware visualization extensions", Proceedings of the 15th ACM conference on Computer and communications security (2008), ACM
- Grance, Timothy, "Guide to selecting information technology security products", Network Security, ~ (2003)
- Mamaghani, Farrokh, "Evaluation and selection of an antivirus and content filtering software", Information management & computer security, 10(1), pp.28~32 (2002)
- Lengyel, Tamas K., "Scalability, fidelity and stealth in the DRAKVUF dynamic malware analysis system", Proceedings of the 30th Annual Computer Security Applications Conference (2014), ACM
- Godse, Manish, "An approach for selecting software-as-a-service (SaaS) product", Cloud Computing, 2009. CLOUD'09. IEEE International Conference on (2009), IEEE
- Bayer, Ulrich, "TTAnalyze: A tool for analyzing malware" (2006), na
- Gorecki, Christian, "Trumanbox:Improving dynamic malware analysis by emulating the internet", Symposium on Self-Stabilizing Systems (2011), Springer Berlin Heidelberg
- 권종훈, "행위 그래프 기반의 변종 악성코드 탐지", 정보보호학회논문지, 21(2), pp.37~47 (2011), 한국정보보호학회
- 이석원, "금융회사 서버 Privilege 계정 운영방식 결정 모델", 정보보호학회논문지, 25(6), pp.1607~1620 (2015), 한국정보보호학회[DOI]