행위기반의 프로파일링 기법을 활용한 모바일 악성코드 분류 기법
Andro-profiler: Anti-malware system based on behavior profiling of mobile malware
0
조회
0
다운로드
6
인용
0
참고문헌
키워드
초록
본 논문에서는 범죄수사에서 사용되는 프로파일링 기법을 이용한 모바일 악성코드 행위 프로파일링을 통하여 효율적인 모바일 악성코드 분류 방법론 Andro-profiler를 제안한다. Andro-profiler는 클라이언트/서버 형태로, 클라이언트 앱이 모바일기기에 설치되어 사용자가 사용하고 있는 앱에 대한 정보를 서버에 전송하고, 서버에서는 해당 앱을 동적 분석 도구인 Droidbox가 설치된 에뮬레이터에서 실행시키면서 발생되는 시스템 콜과 에뮬레이터 로그를 이용하여 해당 앱의 행동을 프로파일링하며, 해당 앱의 프로파일링 목록을 저장된 악성코드 프로파일링 DB와 비교하여악성유무를 판단하고, 악성코드로 판단될 경우 분류를 실시하여 클라이언트에게 결과를 통보한다. 실험결과,Andro-profiler는 1MB의 악성코드를 분류하는데 평균 55초가 소요되었고, 99%의 정확도로 악성코드를 분류하는것을 확인하였으며, 기존 방법론보다 더 정확하게 악성코드를 분류할 수 있다.
Abstract
In this paper, we propose a novel anti-malware system based on behavior profiling, called Andro-profiler. Andro-profilerconsists of mobile devices and a remote server, and is implemented in Droidbox. Our aim is to detect and classify malwareusing an automatic classifier based on behavior profiling. First, we propose the representative behavior profiling for eachmalware family represented by system calls coupled with Droidbox system logs. This is done by executing the maliciousapplication on an emulator and extracting integrated system logs. By comparing the behavior profiling of malicious applicationswith representative behavior profiling for each malware family, we can detect and classify them into malware families. Andro-profiler shows over 99% of classification accuracy in classifying malware families.
참고문헌 (21)
- "AV-TEST Examines 22 Antivirus Apps for Android Smartphones and Tablets"[URL]
- Scalable, Behavior-Based Malware Clustering, "Bayer, U.", NDSS, 8~11 (2009)
- "Contagion blog"[URL]
- "Droidbox Android Application Sandox"[URL]
- Enck, W., "A study of android application security", Proceedings of the 20th USENIX conference on Security, pp.21~21 (2011)
- Enck, W., "On lightweight mobile phone applica tion certification", Proceedings of the 16th ACM conference on Computer and communications security, pp.235~245 (2009)
- "FakeBattScar"[URL]
- "F-Secure.com"[URL]
- "Gartner Says 821 Million Smart Devices Will Be Purchased Worldwide in 2012; Sal es to Rise to 1.2 Billion in 2013" (2012)[URL]
- Kocsis, R. N., "Applied criminal psychology:A guide to forensic behavioral sciences" (2009), Charles C Thomas Publisher
- "Malware. lu"[URL]
- "Mobile Threat Report Q4 2012"[URL]
- Nick Nykodym, "Criminal profiling and insider cybercrime", Digital Investigation, pp.261~267 (2005)
- Pearce, P., "Addroid : Privilege sepa ration for applications and advertisers in android", Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security, pp.71~72 (2012)
- Burguera, I., "Crowdroid : behavior-based malware detection system for Andr oid", Proceedings of the 1st ACM work shop on Security and privacy in sma rtphones and mobile devices, pp.15~26 (2011)
- Peng, H., "Using probabilistic generative models for ranking risks of Android apps", Proceedings of the 2012ACM conference on Computer and communications security, pp.241~252 (2012)
- "Virusshare"[URL]
- "VirusTotal"[URL]
- Yang, C., "Detecting money-stealing apps in alternative Android markets", Proceedings of the 2012 ACM conference on Computer and communications security, pp.1034~1036 (2012)
- Zheng, M., "Adam:An automatic and extensible platform to stress test android anti-virus systems. Detection of Intrusions and Malware, and Vulnerability Assessment", pp.82~101 (2013), Springer
- Zhou, Y., "Hey, you, get off of my market : Detecting malicious apps in official and alternative android markets", Proceedings of the 19th Annual Network and Distributed System Security Symposium, pp.5~8 (2012)