악성코드 유포 네트워크 분석을 위한멀티레벨 에뮬레이션
Multi-Level Emulation for Malware Distribution Networks Analysis
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
최근 악성코드 유포는 단순한 개인적 피해를 넘어 3·20 사이버테러와 같은 사회적인 심각한 문제점을 야기하고 있다. 특히 취약한 웹을 통한 유포방법인 드라이브 바이 다운로드(Drive-by download) 공격은 가장 심각한 위협이되고 있다. 따라서 드라이브 바이 다운로드 공격에 사용되는 악성코드 유포 네트워크(Malware DistributionNetwork, MDN)를 효과적으로 분석하는 것은 악성코드로 인한 피해를 예방하기 위해 매우 중요하다. 악성코드 유포 네트워크를 효과적으로 분석하기 위해서는 웹페이지 내에 포함된 난독화하고 은닉화한 스크립트를 식별해야 하며,본 논문에서는 이를 식별하기 위해 멀티레벨 에뮬레이션 기법을 제안한다. 이를 통해 다양한 형태로 숨겨져 있는 유포지로 연결하는 링크를 분석하여 악성코드 유포 네트워크 분석의 기반을 제공하고자 한다.
Abstract
Recent malware distribution causes severe and nation-wide problems such as 3·20 cyber attack in Korea. In particular,Drive-by download attack, which is one of attack types to distribute malware through the web, becomes the most prevalent andserious threat. To prevent Drive-by download attacks, it is necessary to analyze MDN(Malware Distribution Networks) ofDrive-by download attacks. Effective analysis of MDN requires a detection of obfuscated and/or encapsulated JavaScript in aweb page. In this paper, we propose the scheme called Multi-level emulation to analyze the process of malware distribution. The proposed scheme analyzes web links used for malware distribution to support the efficient analysis of MDN.
참고문헌 (15)
- Provos, N., "The ghost in the browser analysis of web-based malware", Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, pp.4~4 (2007)
- Threat landscape report, "Louis Marinos", ENISA, ~ (2013)
- "Department of labor website hacked to distribute malware" (2013)[URL]
- "NBC hack infects visi tors in 'drive by' cyberattack" (2013)[URL]
- Malware analysis report for Nateon hacking, "HAURI CERT 2Team", HAURI, ~ (2011)
- "DarkSeoul: Sophos-Lab s identifies malware used in south korean internet attack/“" (2013)[URL]
- Malware analysis using 6. 25 DDoS attack, "ASEC", Ahnlab, ~ (2013)
- Ma, J., "Identifying suspicious URLs: an application of large-scale online learning", Proceedings of the 26th Annual International Conference on Machine Learning, pp.681~688 (2009)
- Ma, J., "Beyond Blacklists: Learning to detect malicious web sites from suspicious URLs", Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining, pp.1245~1254 (2009)
- All your iFRAMEs point to us, "Mavrommatis, N.P.P.", Usenix Security, 1~15 (2008)
- Cova, M., "Detection and analysis of drive-bydownload attacks and malicious Javascript code", Proceedings of the 19th international conference on World wide web, pp.281~290 (2010)
- Chen, K.Z., "WebPatrol: Automated collection and replay of web-based malware scenarios", Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, pp.186~195 (2011)
- Moshchuk, A., "Spy- Proxy: execution based detection of malicious web content", Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium, pp.27~42 (2007)
- Wang, G., "Detecting malicious landing pages in malware distribution networks", Proceedings of IEEE DSN (2013)
- "SpiderMonkey"[URL]