API 호출 빈도를 이용한 악성코드 패밀리 탐지 및 분류 방법
Malware Family Detection and Classification Method using API Call Frequency
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
악성코드는 임의의 프로그램을 대상으로 정확하게 식별할 수 있어야 하지만, 분류 기법을 이용하는 기존 연구들은 제한된 샘플에만 적용할 수 있다는 한계가 있다. 본 논문은 임의의 프로그램으로부터 악성코드 패밀리를 탐지하고 분류하기 위해 API 호출 빈도를 이용하는 방법을 제안한다. 제안 방법은 특정 API에 대한 호출 빈도가 임계값을 넘는지 검사하는 규칙을 정의하고, 해당하는 규칙에 의한 비율 정보를 활용하여 특정 패밀리를 식별하는 것이다. 본 논문에서는 결정트리 알고리즘을 응용하여 학습셋으로부터 특정 패밀리를 가장 잘 식별할 수 있는 값으로 임계값을 결정하였다. 4,443개의 샘플을 이용해 학습셋과 시험셋을 나눠 성능을 측정한 결과 패밀리 탐지의 경우 85.1%의 정밀도와 91.3%의 재현율을 보이고, 분류의 경우 97.7%의 정밀도와 98.1%의 재현율을 보여 악성코드 패밀리를 효과적으로 식별할 수 있음을 확인하였다.
Abstract
While malwares must be accurately identifiable from arbitrary programs, existing studies using classification techniques have limitations that they can only be applied to limited samples. In this work, we propose a method to utilize API call frequency to detect and classify malware families from arbitrary programs. Our proposed method defines a rule that checks whether the call frequency of a particular API exceeds the threshold, and identifies a specific family by utilizing the rate information on the corresponding rules. In this paper, decision tree algorithm is applied to define the optimal threshold that can accurately identify a particular family from the training set. The performance measurements using 4,443 samples showed 85.1% precision and 91.3% recall rate for family detection, 97.7% precision and 98.1% reproduction rate for classification, which confirms that our method works to distinguish malware families effectively.
참고문헌 (16)
- "Ransomware" (2021)[URL]
- "Ransomeware" (2021)[URL]
- Uppal, Dolly, "Malware detection and classification based on extraction of API sequences", 2014International conference on advances in computing, communications and informatics (ICACCI), pp.2337~2323 (2014), IEEE
- Garg, Vidhi, "Malware Detection based on API Calls Frequency", 2019 4th International Conference on Information Systems and Computer Networks (ISCON), pp.400~404 (2019), IEEE
- Hansen, Steven Strandlund, "An approach for detection and family classification of malware based on behavioral analysis", 2016 International conference on computing, networking and communications (ICNC), pp.1~5 (2016), IEEE
- "Virustotal" (2021)[URL]
- Sebastián, Marcos, "Avclass: A tool for massive malware labeling", International symposium on research in attacks, intrusions, and defenses, pp.230~253 (2016), Springer
- "Hierarchical clustering" (2021)[URL]
- "Cuckoo Sandbox" (2021)[URL]
- "Malware Type" (2021)[URL]
- "Silhouette" (2021)[URL]
- Pang-Ning Tan, "Introduction to Data Mining", pp.588~ (2019), Pearson Education
- Alsulami, Bander, "Behavioral malware classification using convolutional recurrent neural networks", 2018 13th International Conference on Malicious and Unwanted Software (MALWARE), pp.103~111 (2018), IEEE
- Kumar, Nitish, "Texture-Based Malware Family Classification", 2019 10th International Conference on Computing, Communication and Networking Technologies (ICCCNT), pp.1~6 (2019), IEEE
- Saxe, Joshua, "Deep neural network based malware detection using two dimensional binary program features", 2015 10th International Conference on Malicious and Unwanted Software (MALWARE), pp.11~20 (2015), IEEE
- Yuxin, Ding, "Malware detection based on deep learning algorithm", Neural Computing and Applications, 31(2), pp.461~472 (2019)