명령 실행 모니터링과 딥 러닝을 이용한 파워셸 기반 악성코드 탐지 방법
PowerShell-based Malware Detection Method Using Command Execution Monitoring and Deep Learning
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
파워셸은 닷넷 프레임워크를 기반에 둔, 커맨드 라인 셸이자 스크립트 언어로, 그 자체가 가진 다양한 기능 외에도 윈도우 운영체제 기본 탑재, 코드 은닉 및 지속의 수월함, 다양한 모의 침투 프레임워크 등 공격 도구로서 여러이점을 가지고 있다. 이에 따라 파워셸을 이용하는 악성코드가 급증하고 있으나 기존의 악성코드 탐지 기법으로 대응하기에는 한계가 존재한다. 이에 본 논문에서는 파워셸에서 실행되는 명령들을 관찰할 수 있는 개선된 모니터링기법과, Convolutional Neural Network(CNN)을 이용해 명령에서 특징을 추출하고 실행 순서에 따라Recurrent Neural Network(RNN)에 전달하여 악성 여부를 판단하는 딥 러닝 기반의 분류 모델을 제안한다. 악성코드 공유 사이트에서 수집한 파워셸 기반 악성코드 1,916개와 난독화 탐지 연구에서 공개한 정상 스크립트38,148개를 이용하여 제안한 모델을 5-fold 교차 검증으로 테스트한 결과, 약 97%의 True PositiveRate(TPR)와 1%의 False Positive Rate(FPR)로 모델이 악성코드를 효과적으로 탐지함을 보인다.
Abstract
PowerShell is command line shell and scripting language, built on the .NET framework, and it has several advantages asan attack tool, including built-in support for Windows, easy code concealment and persistence, and various pen-testframeworks. Accordingly, malwares using PowerShell are increasing rapidly, however, there is a limit to cope with theconventional malware detection technique. In this paper, we propose an improved monitoring method to observe commandsexecuted in the PowerShell and a deep learning based malware classification model that extract features from commandsusing Convolutional Neural Network(CNN) and send them to Recurrent Neural Network(RNN) according to the order ofexecution. As a result of testing the proposed model with 5-fold cross validation using 1,916 PowerShell-based malwarescollected at malware sharing site and 38,148 benign scripts disclosed by an obfuscation detection study, it shows that themodel effectively detects malwares with about 97% True Positive Rate(TPR) and 1% False Positive Rate(FPR).
참고문헌 (24)
- S. Albelwi, "frame work for designing the architectures o f deep convolutional neural networks", Entropy, 19(6), pp.242~263 (2017)
- D. Bohannon, "Invoke-obfuscation: po wershell obfusk8tion techniques & ho w to (try to) d”“e`tec`t 'th'+'em" (2016), Der byCon
- D. Bohannon, "Revokeobfuscation:powershell obfuscation de tection and evasion using science", Blackhat USA (2017)
- F.A. Gers, "Learning to forget: continua l prediction with LSTM", 9th Internat ional Conference on Artificial Neural Networks, pp.850~855 (1999)
- D. Hendler, "D etecting malicious powershell comman ds using deep neural networks", Proce edings of the 2018 on Asia Conference on Computer and Communications Sec urity, pp.187~197 (2018), ACM
- R. Kazanciyan, "Inve stigating powershell attacks", BlackHa t USA (2014)
- D.P. Kingma, "Adam: a method for stochastic optimization", a rXiv preprint arXiv:1412.6980v9, ~ (2017)
- N. Mittal, "AMSI: how windows 10 pl ans to stop script-based attacks and how well it does it", Blackhat USA (2016)
- V. Nair, "Rectified li near units improve restricted boltzma nn machines", Proceedings of the 27th international conference on machine l earning, pp.807~814 (2010)
- S.M. Pontiroli, "Th e tao of .NET and powershell malwar e analysis", Virus Bulletin Conference (2015)
- A. Rousseau, "Hijacking .NET to defe nd powershell", arXiv preprint arXiv:1709.07508, ~ (2017)
- N. Srivastava, "Dropout: a simple way to prevent neural networks from overfitting", The Journal of Machine Learning Research, 15(1), pp.1929~1958 (2014)
- S. Tanda, "Powershell inside out: appl ied .NET hacking for enhanced visibil ity" (2017), Code Blue
- D. Tran, "A LSTM based fra mework for handling multiclass imbal ance in DGA botnet detection", Neuro computing, 275, pp.2401~2413 (2018)
- McAfee labs threats report march 2018, "McAfee", McAfee, ~ (2018)
- Symantec, "Increased use of powershel l in attacks" (2016), Symantec
- "Malicious powershell detecti on via machine learning"[URL]
- "Antimalware scan interfac e"[URL]
- "PowerShell"[URL]
- "Installing windows powers hell"[URL]
- "Script tracing and logging"[URL]
- "Pulling back the curtains on encodedcommand powersh ell attacks"[URL]
- "DotNetHooking"[URL]