고속 정적 분석 방법을 이용한 폴리모픽 웜 탐지
Polymorphic Worm Detection Using A Fast Static Analysis Approach
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
통신망을 통하여 자동적으로 확산되는 악성 프로그램인 웜에 대응하기 위하여, 웜 관련 패킷들을 분석하여 시그니처를 생성하여 웜을 탐지하는 방법들이 많이 사용되고 있다. 그러나 이런 시그니처-기반 탐지 기법을 회피하기 위하여, 변형된 폴리모픽 형태의 공격 코드 사용이 점차 증가하고 있다. 본 논문에서는 폴리모픽 공격 코드의 복호화 루틴을 탐지하기 위한 새로운 정적 분석 방법을 제안한다. 제안된 방법은 통신망 플로에서 폴리모픽 공격 코드에 함께 포함되어 암호화된 원본 코드를 복호화하는 역할을 수행하는 코드 루틴을 탐지한다. 실험 결과를 통하여 제안된 방법이 정적 분석 방지 기법들이 사용된 폴리모픽 코드들도 탐지할 수 있는 것을 보여준다. 또한 처리 성능에서 에뮬레이션 기반 분석 방법보다 효율적인 것으로 나타났다.
Abstract
In order to respond against worms which are malicious programs automatically spreading across communication networks, worm detection approach by generating signatures resulting from analyzing worm-related packets is being mostly used. However, to avoid such signature-based detection techniques, usage of exploits employing mutated polymorphic types are becoming more prevalent. In this paper, we propose a novel static analysis approach for detecting the decryption routine of polymorphic exploit code. Our approach detects a code routine for performing the decryption of the encrypted original code which are contained with the polymorphic exploit code within the network flows. The experiment results show that our approach can detect polymorphic exploit codes in which the static analysis resistant techniques are used. It is also revealed that our approach is more efficient than the emulation-based approach in the processing performance.
참고문헌 (18)
- "Snort"[URL]
- "Metasploit"[URL]
- "K2, ADMmutate"[URL]
- T. Detristan, "Polymorphic shellcode engine using spectrum analysis", Phrack Magazine, 11(61) (2003)
- "Alpha2"[URL]
- "TAPiON"[URL]
- R. Chinchani, "A Fast Static Analysis Approach To Detect Exploit Code Inside Networks Flows", Proc. 8th International Symposium on Recent Advances in Intrusion Detection (RAID), pp.284~308 (2005)
- C. Krugel, "Polymorphic worm detection using structural information of executables", Proc. 8th International Symposium on Recent Advances in Intrusion Detection (RAID), pp.207~226 (2005)
- X. Wang, "SigFree: A Signature-free Buffer Overflow Attack Blocker", Proc. 15th USENIX Security Symposium, pp.225~240 (2007)
- C. Linn, "Obfuscation of Executable Code to Improve Resistance to Static Disassembly", CCS’03, pp.290~299 (2003)
- M. Polychronakis, "Network-Level Polymorphic Shellcode Detection Using Emulation", Proc. Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), pp.54~73 (2006)
- M. Polychronakis, "Emulation-based Detection of Non-self-contained Polymorphic Shellcode", Proc. International Symposium on Recent Advances in Intrusion Detection (RAID), pp.87~106 (2007)
- Q. Zhang, "Analyzing network traffic to detect self-decrypting exploit code", Proc. ACM Symposium on Information, Computer and Communications Security (ASIACCS), pp.20~22 (2007)
- J. Newsome, "Polygraph: Automatically Generating Signatures for Polymorphic Worms", In Proc. of the IEEE Security & Privacy Symp., pp.226~241 (2005)
- K. Wang, "Anomalous Payload-based Network Intrusion Detection", Proc. of the 7th Int'l Symp. on Recent Advances in Intrusion Detection(RAID), pp.201~222 (2004)
- Y. Tang, "Defending Against Internet Worms: a Signature-based Approach", Proc. of the 24th Annual Joint Conf. of IEEE Computer and Comm. Societies(INFOCOM), pp.1384~1394 (2005)
- P. Akritidis, "STRIDE: Polymorphic Sled Detection through Intrusion Sequence Analysis", Proc. of the 20th IFIP Int'l Information Security Conf.(SEC'05), pp.375~392 (2005)
- "GNU Manuals Online, GNU Project-Free Software Foundation"[URL]