악성코드 분석을 위한 Emulab 활용 방안 연구
Research on Utilizing Emulab for Malware Analysis
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
빠르게 증가하는 악성코드를 효율적으로 분석하기 위해 가상화 환경이 많이 사용되고 있다. 하지만 이를 인지한악성코드 제작자들은 가상화 환경 탐지 기술을 이용하여 악성코드가 가상화 환경에서 구동되는 것을 판단하면 악성행위를 수행하지 않는 등의 분석 회피 기술을 적용하고 있다. 분석 회피 기술을 무력화하기 위한 연구도 계속되고있지만 몇 가지 가상화 환경 탐지 기술로써 악성코드 분석은 상당히 저해를 받는다. 미국 Utah 대학에서 개발한Emulab은 실제 시스템을 연구자가 원하는 대로 실시간으로 할당할 수 있다. 본 연구에서는 이 Emulab을 악성코드 분석에 어떻게 활용할 수 있는지 알아보고 그 방안을 제시한다.
Abstract
Virtual environment is widely used for analyzing malware which is increasing very rapidly. However, knowing this trend, hackers are adopting virtual environment detection techniques for malware to kill itself or stop malicious behaviors when detecting virtual environments. Various research is going on in order to thwart any efforts to utilize anti-virtualization techniques, but until now several techniques can evade most of well known virtual environments, making malware analysis very difficult. Emulab developed by Utah University assigns real systems and networks as researchers want in realtime. This research seeks how to use Emulab for malware analysis.
참고문헌 (22)
- "2014 Malware Damages"[URL]
- "Malware creation increasing, Trojans mo st popular attack"[URL]
- "New malware numbers jump sharply in 2014"[URL]
- R.L. Sites, "Binary translation", Communications of the ACM, 36(2), pp.69~81 (1993)
- Joel Auslander, "Fast, effective dynamic compilation", Proceedings of the ACM SIGPLAN 1996 conference on Programming language design and implementation, pp.149~159 (1996)
- "Intel Virtualization Technology"[URL]
- "AMD Virtualization"[URL]
- P. Ferrie, "Attacks on virtual machine emulators", Symantec Security Response, ~ (2006)
- "On the Cutting Edge: Thwarting Virtual Machine Detection" (2006)[URL]
- "Blue Pill Project"[URL]
- "Utah Emulab; Network Emulation Testb ed Home"[URL]
- "KISTI Emulab; Network Emulation Test bed Home"[URL]
- 이만희, "사이버 보안 연구 프레임워크로써의 Emulab 활용 동향연구", 정보보호학회논문지, 23(6), pp.1169~1180 (2013), 한국정보보호학회[DOI]
- "Using the RDTSC Instruction for Performance Monitoring"[URL]
- "Thompson, Christopher, Maria Huntley, and Chad Link, “Virtualization detection:New strategies and their effectiveness"[URL]
- "Detecting the Presence of Virtual Machines Using the Local Data Table"[URL]
- X. Chen, "Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware", Proceedings of Dependable Systems and Networks(DSN), pp.177~186 (2008)
- "Pafish"[URL]
- M. Lindorfer, "Detecting Environment –Sensitive Malware", Proceedings of Symposium on Recent Advances in Intrusion Detection(RAID), pp.338~357 (2011)
- N. M. Johnson, "Differential slicing : Identifying causal execution differences for security applications", Proceedings of IEEE Symposium on Security and Privacy, pp.347~362 (2011)
- D. Kirat, "Barecloud : bare-metal analysis-based evasive malware detection", Proceedings of the 23rd USENIX conference on Security Symposium, pp.287~301 (2014)
- D. Kirat, "MalGene : Automatic Extraction of Malware Analysis Evasion Signature", Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp.769~780 (2015)