CN100504903C - A Malicious Code Automatic Identification Method - Google Patents

Abstract

The invention belongs to the field of malicious code automatic analysis, and a malicious code automatic identification method. The invention first dismantles an executable program sample under analysis into components under analysis; then, compare a component under analysis with a component affected by known malicious behaviors, in order to automatically determine whether the sample under analysis is a malicious code. The invention has advantages of broad analysis coverage scope, high analysis speed on malicious samples, and updating malicious code behavior component library.

Description

A Malicious Code Automatic Identification Method

technical field

The invention belongs to the field of automatic analysis of malicious codes, in particular to a method for accelerating the analysis of malicious codes by using reverse engineering technology and code similarity comparison technology.

Background technique

On the current Internet, malicious codes are ubiquitous and flooding, seriously threatening network security. Malicious code-related technologies are relatively difficult to implement, but in recent years, with the popularization of the Internet, there have been more and more websites on the Internet dedicated to discussing malicious code implementation technologies. People can directly obtain the source code of malicious code from the Internet. Source code becomes available at your fingertips. These have promoted the proliferation of malicious code variants. In different variants of malicious code, the phenomenon of code segment reuse is very obvious. Many new malicious codes have adopted the previous malicious code implementation technology, and even directly use existing sources. Code, only a few new samples will add some new functionality or new implementation methods. At present, the number of malicious codes and their variants has grown explosively, and traditional manual analysis methods can no longer meet the needs of rapid analysis of malicious codes.

In the field of automatic analysis of malicious codes, there are currently two types of automatic analysis methods: dynamic analysis and static analysis. The dynamic analysis method refers to dynamically executing the program to be analyzed in a safe environment and observing its running process and results. This analysis method can be used to discover some behaviors in malicious code, but sometimes the environment does not meet the requirements for code operation, or If it does not meet the triggering conditions of malicious behaviors, it is difficult to execute all paths dynamically. In addition, the results of dynamic analysis and monitoring also need to be further analyzed and summarized. Static analysis methods mainly include pattern matching and semantic analysis. By checking whether the program contains a given behavior or semantic pattern, it is judged whether the program contains specific malicious behavior. This approach establishes correspondences between malicious behaviors and program fragments, but it is difficult to build robust and discriminative models.

Considering the above, the present invention proposes a method for statically analyzing malicious behaviors in malicious codes, which has relatively low modeling requirements. According to the characteristics of binary programs and malicious codes, the program is split into components, and then analyzed and analyzed. Matching, this automatic analysis method has a very good analysis effect on malicious programs, especially botnet programs, and can quickly and automatically discover malicious behaviors in samples to be analyzed.

Botnet (Botnet) refers to the combination of some machines that have been compromised. These machines are called "bots". Botnets often contain command-line control frameworks. They use worms, Trojan horses or backdoors to The tool captures hosts on the network and lurks down, and then accepts the source of the botnet, that is, the remote control of the botherder through its remote control module. These botnet programs usually also include functional modules for reproduction and proliferation, which can scan the network automatically or under the command of their controllers, invade other vulnerable hosts, and leave their own copies. Botnet controllers often use bots to achieve certain malicious goals, such as stealing user bank card information and implementing denial-of-service attacks on specific servers. The functional modules often included in the botnet program are: command control module, replication/propagation module, host control module, download/upload file, module information stealing module, anti-detection/anti-analysis module, etc., its structure is shown in Figure 1 (botnet For information on structure and mechanism, please refer to literature: P.Barford and V.Yegneswaran, "An Inside Look at Botnets", Special Workshop on Malware Detection, Advances in Information Security, 2006).

Contents of the invention

The purpose of the present invention is to provide a method for automatic identification of malicious codes, using reverse engineering technology and code similarity comparison technology to accelerate the analysis of malicious codes, effectively improving the efficiency and coverage of malicious code analysis.

Above-mentioned purpose of the present invention is achieved by following technical scheme:

A method for automatically identifying malicious codes, the steps comprising:

1) Analyze the executable program sample to be analyzed, and obtain the function node and function call information in the program;

2) According to the above function nodes and function call information, extract the head functions of each component and all functions directly or indirectly called, and obtain the components to be analyzed marked by the head functions of each component:

3) Carry out similarity comparison between each component to be analyzed and each known malicious behavior component in the known malicious behavior component library successively, until a component to be analyzed is similar to a known malicious behavior component, or all components to be analyzed are compared;

4) If the component to be analyzed is similar to the known malicious behavior component in the known malicious behavior component library, it is determined that the program contains malicious behavior.

Further, the present invention proposes a method for expressing and extracting components in binary executable programs from the domain knowledge of malicious codes, and according to the characteristics of binary malicious codes, a method for expressing malicious behavior components by using function call clusters is designed, wherein the function clusters directly or indirectly The function that calls all other functions in the cluster is called the component head function;

In the present invention, there are three methods for identifying component header functions:

[1] Component identification method based on program scheduling: Identify component header functions scheduled by the scheduler:

Program scheduling is the process of mapping a message to a specific sequence of codes. Malicious codes, especially botnet programs, usually invoke functional components according to received instructions. Therefore, after identifying the calling function, we can easily extract the malicious behavior functional component called by the calling function.

[2] Component identification method based on key APIs: identify component header functions that directly or indirectly call a set of key APIs:

Functional components in malicious code usually need to complete a malicious task, such as killing the process of an antivirus program, recording keyboard activity, attacking a victim website, and so on. In order to complete these functions, these components often need to call a set of key system APIs directly or indirectly. Instead, potential artifacts can be extracted by examining the functions that aggregate these APIs. At this time, API collection is very important for extracting component functions, which can be collected by defining libraries, or obtaining known malicious components from other methods.

[3] Component identification method based on the principle of multiple calls: identify component header functions that are repeatedly called by different function segments in the program:

If the repeatedly called function cluster is not a library function or an API provided by the system, it is generally a function module written by the user to complete an independent function. This feature can also be used to extract malicious artifacts in programs. The required information is the collection of calling functions and called functions and the corresponding function call graph. If a function A calls functions B and C, and functions B and C call function D, then function D can be represented as a potentially reusable module because D is called multiple times, as shown in Figure 2. In order to avoid misjudgment of library functions and system API functions as reusable modules, it is necessary to define exclusion rules and ignore repeated call information of these functions.

Further, the present invention proposes a method of "weight-threshold" function call binary program component similarity that is not exactly matched, and detects the existing component function clusters by comparing the component function clusters obtained in the new sample with the function clusters in the known malicious component library. Known malicious artifacts.

Further, the present invention proposes a method for building a known malicious behavior component library, the steps of which include:

1) Analyze known malicious program samples to obtain function nodes and function call information in the program;

2) According to the characteristics of known malicious programs, extract each component header function and all functions called directly or indirectly from the functions obtained in step 1), and obtain components marked with each component header function;

3) Analyze the above-mentioned components, identify malicious behavior components, and store the malicious behavior components in the known malicious behavior component library according to the set format.

The present invention has the following positive effects:

1. The method provided by the present invention is a static malicious code analysis method, and compared with the dynamic analysis method, the analysis coverage is wider; compared with the method of model checking and semantic analysis, it is not necessary to design an accurate malicious behavior model, Instead, build a malicious component library. Known malicious components are mainly extracted automatically based on the structural characteristics of malicious programs, which is much easier than building a malicious behavior model;

2. For the samples of detected malicious components, the present invention can classify the components obtained by splitting them into two types: "known" and "unknown", which can speed up the analysis process of malicious samples. For the malicious components that have been analyzed, the analysis report can be automatically generated by the system to avoid repeated analysis work; and if some components in a malicious code do not find a corresponding match in the known malicious component library, this component is likely to contain For new malicious behaviors, the present invention can pick out these components for key analysis, and the results obtained from the analysis can be used to supplement and improve the known malicious component library;

3. According to the similarity relationship between malicious components, the analyzed malicious samples can be classified, the source of new samples can be traced, and the genealogical relationship between malicious code samples can be built according to the similarity of components.

Description of drawings

Describe the present invention in further detail below in conjunction with accompanying drawing and specific embodiment:

Figure 1 Schematic diagram of the program structure of the botnet program

Fig. 2 is a schematic diagram of the "component" defined by the present invention

Figure 3 is a flowchart of a specific implementation case

Detailed ways

In the present invention, a component is defined as a program module composed of a cluster of related functions to complete a specific function. This function cluster contains a header function, that is, the construction header, which directly or indirectly calls all other functions in the cluster. Figure 2 is a schematic diagram of the components defined in the present invention.

The invention uses component extraction technology and binary code similarity comparison technology in the field of reverse engineering. Component extraction technology is an important research topic in the field of software engineering, and its main goal is to identify reusable components from legacy code. The method of component extraction and evaluation (see literature: Luo Jing, Zhang Lu, Sun Jiasu "Review of Component Extraction Technology", Computer Science, Volume 32, December 2005), including domain knowledge, structure and component measurement, etc., this kind of The method is also used in the field of analysis of malicious code. Binary code similarity comparison technology (see E. Carrera and G. Erdelyi, "Digital genome mapping: Advanced binary malware analysis", Proceedings of 15th Virus Bulletin International Conference (VB2004), p187-197, 2004) is widely studied in the field of software engineering The topic is now being more and more applied to the field of malicious code research. API sequences, function call graphs, control flow graphs, program dependency graphs, etc. are all used for binary code similarity comparison.

Fig. 3 shows the flow chart of a specific implementation case of the present invention, and its flow process is as follows:

1. Build a malicious component library

[1] For some known malicious program samples, use a disassembler to analyze, and extract the function node and function call information in the program according to the program function feature information (for the method of extracting function node and function call information, please refer to "Hacker Anti- Compilation Revealed", written by Kris Kaspersky, translated by Tan Mingjin, Electronic Industry Press. 2005, P85);

[2] According to the characteristics of the known malicious code program scheduling, the header function of the malicious component is extracted. There are two common implementations of program scheduling. The first is direct scheduling, where the dispatch function parses the received message, and then directly calls the corresponding function. The second is registration scheduling: each component registers itself in the global scheduling table, and the scheduler consults the global scheduling according to the command parsing results The table calls the corresponding function. Here the present invention extracts the known malicious component header function from the function called by the scheduling function irc_parseline () in the rbot and sdbot samples and the function registered by the registration function g_cMainCtrl.m_cCommands in the agobot sample;

[3] According to the header function and the function node relationship in the program, the known malicious components are extracted. After supplementing the source and function information of these known malicious components, save them in the known malicious component library.

2. Extract the candidate components in the executable program sample to be analyzed

[1] For the unknown sample to be analyzed, use a disassembler to analyze, and extract the function node and function call information in the program according to the feature information of the program function;

[2] Extract the components to be selected, and use the principle of key API aggregation and multiple calls to find malicious component header functions, such as killing antivirus programs, usually need to call (AdjustTokenPrivileges, CreateToolhelp32Snapshot, LookupPrivilegeValueA, Module32First, OpenProcess, Process32First, Process32Next, TerminateProcess) and other API collections; record keystroke activities, usually need to call (GetAsyncKeyState, GetForegroundWindow, GetKeyState) and other API collections;

3. Compare the component similarity between the component to be selected and the components in the known malicious behavior component library. If it shows that there is a component that matches the known malicious component, it is determined that the sample to be analyzed is malicious code, and includes a known family. Some intentional malicious behavior components will automatically generate sample analysis reports based on these information; at the same time, suspected malicious behavior components will be screened out for further in-depth analysis, and the results obtained from the analysis will supplement and improve the known malicious behavior component library.

Among them, the component similarity is compared, and the known malicious components are identified by comparing the component function clusters obtained in the new sample with the function clusters in the known malicious component library. If the component feature similarity between the function in the candidate component of the new sample and the component header function in the known malicious component is higher than the preset threshold (here set as 0.8), it is considered that the malicious component is included in the new sample. Therefore, the problem of component detection is transformed into a problem of function comparison. The present invention proposes a method for inaccurate matching of "weight-threshold" function call graph, which mainly includes the following four steps:

1. Perform topological sorting on the function call graph of the target sample and the function call graph of known malicious components (see literature: Xu Zhuoqun, Yang Dongqing, Tang Shiwei, Zhang Ming, "Data Structure and Algorithm", Higher Education Press, Chapter 6 , p183, 2004); Arrange the function nodes in the function call graph into an ordered sequence, so that the function nodes in the front of the sequence will not call the function nodes in the back, except for recursive calls;

2. Calculate the node weight W(F): Calculate the node weight of each function in the target sample and known malicious components along the topological sequence. If a function node does not call any function, the weight of the function node is set to 1, and if a function calls other functions (excluding recursive calls), its weight is set to the weight of the called function plus 1;

3. Calculate the similarity S(F, G) calculated based on weight and threshold: Calculate the similarity between each function F in the sample to be analyzed and each function G in the known component along the topological sequence. There are three situations as follows:

a) When both functions are APIs, if they are the same, the similarity is recorded as 1, and if they are different, the similarity is recorded as 0;

b) When one function is an API and the other is not, the similarity is recorded as 0;

c) When neither of the two functions is an API, its similarity is defined as the maximum value of the sum of the weighted similarities of the function pairs in the function set called by the two; if the maximum value is lower than a preset threshold (such as 0.8), then the similarity between these two functions is defined as 0. The specific calculation method is as follows:

i. Let the node weight of F be larger, denoted as T;

ii. Denote the set of functions called by F as {f ₀ , f ₁ , ..., f _m }, the set of functions called by G as {g ₀ , g ₁ , ..., g _n }, and denote r=min (m, n). Note that because the calculation of similarity is carried out along the topological sequence, the similarity between f _i and g _j has been calculated, that is, S(f _i , g _j ) is known;

iii. For the sequence G _k ={g _k0 , g _k1 ,...,g _kr } (where 0≦k _i ≦r, and k ₁ ≠k _j if i≠j), candidate weighted similarity S′=( 1+∑(W(fi)＊S(f _i , g _ki )))/T;

iv. Note that the sequence G _k ′={g _k0 ′, g _k1 ′, ..., g _kr ′} is a sequence that makes S′ the largest, and record the maximum value as S _max ;

v. If S _max is greater than a preset threshold, such as 0.8, then the similarity between F and G is S _max ; otherwise, the similarity between F and G is 0.

4. For a known malicious component header function F', if there is a function G' in the target sample, so that S(F', G') is higher than the preset threshold (such as 0.8), it can be considered that there is a function G' in the target sample The malicious component. In the experiment, when the preset threshold is 0.8, the effect is the best.

As mentioned above, the present invention utilizes the feature of function code reuse in malicious programs, and proposes a brand-new method based on binary component analysis to realize automatic identification of malicious codes. The method in the present invention has been applied to the botnet program samples captured by China Honeynet Alliance Beida Honeynet Project Group (http://www.icst.pku.edu.cn/honeynetweb/index.htm), greatly accelerating The speed of malicious code sample analysis is improved, good results are obtained, and the purpose of the present invention is realized. The invention has good practicability and popularization and application prospect.

Although specific embodiments and drawings are disclosed for the purpose of illustrating the invention, the purpose is to help understand the content of the present invention and implement it accordingly, but those skilled in the art can understand that: without departing from the spirit of the present invention and the appended claims Various substitutions, changes and modifications are possible within the scope and scope. Therefore, the present invention should not be limited to the content disclosed in the preferred embodiments and drawings, and the protection scope of the present invention should be defined by the claims.

Claims (10)

1. A malicious code automatic identification method, the steps comprising: 1.1 Analyze the executable program sample to be analyzed, and obtain the function node and function call information in the program; 1.2 According to the above function nodes and function call information, extract the head functions of each component and all the functions directly or indirectly called, and obtain the components to be analyzed identified by the head functions of each component. The head functions of the components represent the direct or indirect Functions that indirectly call other functions in the cluster; 1.3 Compare the similarity of each component to be analyzed with each known malicious behavior component stored in the known malicious behavior component library, until a component to be analyzed is similar to a known malicious behavior component, or all the components to be analyzed are compared. member; 1.4 If the component to be analyzed is similar to the known malicious behavior component in the known malicious behavior component library, it is determined that the program contains malicious behavior. 2. The method for automatically identifying malicious codes as claimed in claim 1, wherein a disassembler is used to analyze the executable program sample to be analyzed described in step 1.1. 3. The malicious code automatic identification method according to claim 1, characterized in that the component header function described in step 1.2 is obtained by identifying the function called by the scheduling function. 4. The malicious code automatic identification method according to claim 1, characterized in that the component header function described in step 1.2 is obtained by identifying functions that directly or indirectly call a set of key APIs. 5. The malicious code automatic identification method according to claim 1, characterized in that the component header function described in step 1.2 is obtained by identifying functions repeatedly called by different function segments in the program. 6. the malicious code automatic identification method as claimed in claim 1, is characterized in that, the similarity comparison described in step 1.3 comprises the following steps: 6.1 Perform topological sorting on the function call graph of components to be analyzed and known malicious behavior components: Arrange the function nodes in the function call graph into a sequence, so that unless a recursive call occurs, the function corresponding to the function node in the front of the sequence will not call the function corresponding to the function node in the rear; 6.2 Set the function node weights in the components to be analyzed and known malicious behavior components along the sequence: If the function corresponding to a function node does not call any function, the weight of the node is set to 1. If the function corresponding to a function node calls other functions, excluding recursive calls, the weight of the node is set to 1 plus the weight of the function node corresponding to the called function; 6.3 Calculate the similarity between each function in the component to be analyzed and each function in the known malicious behavior component along the sequence: When two functions are both APIs, if they are the same, the similarity is recorded as 1, and if they are different, the similarity is recorded as 0; when one function is API and the other is not, the similarity is recorded as 0; when two functions When neither is an API, its similarity is the sum of the weighted similarities of the functions in the function set called by it. When the similarity of the function is lower than a preset threshold, the similarity of the two functions is defined as 0; 6.4 Judgment of similarity comparison results: If there is no less than one function in the component to be analyzed so that the similarity between the function and the header function of the known malicious component is higher than the preset threshold, then the component to be analyzed is considered similar to the known malicious component. 7. The malicious code automatic identification method according to claim 6, characterized in that the preset threshold value in the similarity comparison step is 0.8. 8. The malicious code automatic identification method as claimed in claim 1, wherein if the executable program sample is determined to contain malicious behavior, other components in the executable program sample that are not similar to those in the known malicious behavior component library Perform analysis, and store components confirmed as malicious behavior components in the known malicious behavior component library in the format required by the known malicious behavior component library. 9. The malicious code automatic identification method as claimed in claim 1, wherein the step of building the known malicious behavior component library described in step 1.3 comprises: 9.1 Analyze known malicious program samples to obtain function nodes and function call information in the program; 9.2 According to the characteristics of known malicious programs, extract the header functions of each component and all the functions directly or indirectly called from the functions obtained in step 9.1, and obtain the components identified by the header functions of each component; 9.3 Analyze the above-mentioned components, identify malicious behavior components, and store the malicious behavior components in the known malicious behavior component library according to the set format. 10. The malicious code automatic identification method according to claim 9, characterized in that a disassembler is used to analyze the known malicious program samples described in step 9.1 in the construction method of the known malicious behavior component library.

Images