KR101550820B1 - The device for analyzing a malware based on similarity - Google Patents

Abstract

An apparatus for analyzing a malicious code based on a degree of similarity according to an embodiment of the present invention includes a malicious code database storing a structured string of malicious codes; An unpacking unit for unpacking a program estimated to be malicious code; A code extracting unit for extracting a binary code from the unpacked program; A decompiler for converting the extracted binary code into another code; And a code analyzer for converting the converted code into a structured string and comparing the converted string with the similarity of the string stored in the malicious code database to determine whether the program is malicious code.

Description

[0001] The present invention relates to a device for analyzing a malicious code based on similarity,

The present invention relates to an apparatus for analyzing malicious code based on the degree of similarity.

As the Internet and computer technology continue to develop, the Internet and computers have become essential technologies for people all over the world. Along with the development of the Internet and computer technologies, there are also increasing attempts to exploit these technologies to gain undue profits. For example, malicious code (Malware) is installed and distributed on users' computers, and there is an increasing number of ways to gain unfair advantage from users. Here, malware refers to a program that is infiltrated or installed in a computer without permission of a computer user and malicious. This is determined by the intention of the person who created the program, rather than the characteristics of the program itself. These malicious codes are computer viruses, worms, Trojan horses and spyware. In addition to these, harmful and unnecessary software are all classified into malware category. Belongs.

As a result, antivirus vendors offer a variety of solutions to eliminate malware, but hackers are massively producing and distributing new malware that is difficult to detect, avoiding the detection of antivirus . In particular, new malware has increased exponentially in the last five years. In addition, most of the new malware is a variant of conventional malware.

Thus, when the emergence of new malware and the high rate of malware variants are examined, a device is needed to quickly analyze the new variant codes.

Silvio Cesare et al. "Malwise: An Effective and Efficient Classification System for Packed and Polymorphic Malware," IEEE Transactions on Computer 2013 Silvio Cesare et al. "Malware Variant Detection Using Similarity Search over Control Flow Graphs", TSPC 2011

SUMMARY OF THE INVENTION It is an object of the present invention to provide an apparatus for analyzing a malicious code based on the degree of similarity capable of accurately analyzing a malicious code.

According to another aspect of the present invention, there is provided an apparatus for analyzing a malicious code based on a degree of similarity capable of analyzing a malicious code at a high speed.

An apparatus for analyzing a malicious code based on a degree of similarity according to an embodiment of the present invention includes a malicious code database storing a structured string of malicious codes; An unpacking unit for unpacking a program estimated to be malicious code; A code extracting unit for extracting a binary code from the unpacked program; A decompiler for converting the extracted binary code into another code; And a code analyzer for converting the converted code into a structured string and comparing the converted string with the similarity of the string stored in the malicious code database to determine whether the program is malicious code.

In the apparatus for analyzing a malicious code based on the degree of similarity according to an embodiment of the present invention, the code analyzing unit may include a character string converting unit for converting the converted code into a structured character string; A similarity measuring unit for filtering the converted string and the strings stored in the malicious code database according to a predetermined condition and measuring the similarity of the unfiltered strings; And a malicious code discrimination unit for discriminating whether the program is a malicious code according to the result of the similarity measurement.

In the apparatus for analyzing a malicious code based on the degree of similarity according to an embodiment of the present invention, the code analyzing unit may determine whether the converted character string and the strings stored in the malicious code database are the same by using a hash value, And may include a first filter that filters the same strings.

In the apparatus for analyzing a malicious code based on the degree of similarity according to an embodiment of the present invention, the code analyzing unit determines the difference in length between the converted character string and the character string stored in the malicious code database, Lt; RTI ID = 0.0 > a < / RTI >

In the apparatus for analyzing a malicious code based on the degree of similarity according to an embodiment of the present invention, the code analyzer may discriminate a difference between the converted character string and the number of characters constituting the character string stored in the malicious code database, And a third filter for filtering the strings whose sum of differences in the number of characters is equal to or greater than a predetermined value.

According to the apparatus for analyzing malicious codes based on the similarity according to the present invention, the accuracy of the similarity analysis can be enhanced by using an edit distance algorithm.

Further, according to the apparatus for analyzing malicious code based on the degree of similarity according to the present invention, it is possible to improve the processing speed by reducing the target character strings to be compared for similarity analysis.

1 is a schematic diagram of an apparatus for analyzing malicious code based on the degree of similarity according to an embodiment of the present invention.
2 is a diagram showing a control flow graph of a program composed of four functions.
3 is a diagram illustrating a process of converting a control flow graph of a function constituting a program into a structured string.
4 is a conversion table for the branch instruction word.
5 is a diagram for explaining a process of filtering by a first filter of an apparatus for analyzing malicious code based on the degree of similarity according to an embodiment of the present invention.
6 is a diagram for explaining a process of filtering by a second filter of an apparatus for analyzing malicious code based on the degree of similarity according to an embodiment of the present invention.
7 is a diagram for explaining a process of filtering by a third filter of an apparatus for analyzing malicious code based on the degree of similarity according to an embodiment of the present invention.
8 is a view for explaining a process of measuring the edit distance.
9 is a diagram showing a character string for measuring the similarity in an apparatus for analyzing malicious code based on the similarity according to an embodiment of the present invention.

The terms used in this specification will be briefly described and the present invention will be described in detail.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments.

Also, in certain cases, there may be a term selected arbitrarily by the applicant, in which case the meaning thereof will be described in detail in the description of the corresponding invention. Therefore, the term used in the present invention should be defined based on the meaning of the term, not on the name of a simple term, but on the entire contents of the present invention.

When an element is referred to as "including" an element throughout the specification, it is to be understood that the element may include other elements as well, without departing from the spirit or scope of the present invention. Also, the terms "part," " module, "and the like described in the specification mean units for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software .

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

1 is a schematic diagram of an apparatus for analyzing malicious code based on the degree of similarity according to an embodiment of the present invention. An apparatus 100 for analyzing malicious code based on the degree of similarity according to an embodiment of the present invention includes an unpacking unit 110, a code extracting unit 120, a decompiler 130, a code analyzing unit 140, And a code database 150.

The unpacking unit 110 can unpack the program estimated as malware and expose the binary code of the program estimated to be malware to the outside. Generally, since the program is packed, unpacking is required to extract the actual code. Accordingly, the unpacking unit 110 can unpack the binary code of the program and expose it to the outside.

In addition, a program estimated as malware may include at least one function. The functions forming the unpacked program can also be expressed as a control flow graph.

2 is a diagram showing a control flow graph of a program composed of four functions. Generally, the functions constituting the program may include a form in which output values are changed according to input values and conditions, and can be represented by a control flow graph. When the program is composed of four functions, four functions can represent a control flow graph as shown in FIG.

The code extracting unit 120 can extract the binary code from the program. The code extracting unit 120 can extract the binary code from the program in which the binary code is revealed to the outside by the unpacking unit 110. [

The decompiler 130 can convert the extracted binary code into a high level code such as the C language.

The code analysis unit 140 may convert the high-level code into a structured malware string, and determine whether the program having the converted string is malware. More specifically, the code analysis unit 140 may convert a control flow graph into a structured malware string.

In addition, metadata of the converted character string (Meta data) can be calculated. Then, it is possible to determine whether the converted string is malware by comparing the value of the calculated metadata with the metadata value of the malicious codes (Malwares) stored in the malicious code database.

The code analyzing unit 140 may include a character string converting unit 141, a similarity measuring unit 142, and a malicious code determining unit 143. In addition, the malware database 150 may store a structured string of known malicious codes.

A function with control flow can be decompiled, leaving only branch instructions. And finally, it can be converted into a structured string. When converting a branch instruction into a structured string, various branch instructions may exist, and such branch instructions may be represented by a translation table.

FIG. 3 is a diagram illustrating a process of converting a control flow graph of a function constituting a program into a structured string, and FIG. 4 is a conversion table for a branch instruction.

As shown in Fig. 3, the malicious code A may be in the form (B) having only branch instructions after being decompiled. Then, it can be transformed and expressed as a structured string (C). When converting from B to C, there are various branch instructions, and the conversion table for that branch instruction may be as shown in FIG. In FIG. 4, all of the target commands may be branch instructions.

In this way, the string conversion unit 141 of the code analysis unit 140 can convert the functions constituting the program estimated as malware into a structured string such as C in Fig.

The similarity measuring unit 142 of the code analyzing unit 140 may measure the similarity of the malware. The similarity measuring unit 142 includes a metadata calculating unit 142a, a storing unit 142b, a first filter 142c, a second filter 142d, a third filter 142e, a string similarity measuring unit 142f, And a code similarity measurement unit 142g.

The metadata operation unit 142a may calculate meta data of the structured character string. In the apparatus 100 for analyzing malicious codes based on the degree of similarity according to an embodiment of the present invention, the meta data may be a value indicating a characteristic of the structured character string.

For example, the meta data may include at least one of a hash value, a character string length, and the number of characters of a character string. In the apparatus 100 for analyzing a malicious code based on the similarity according to the embodiment of the present invention, the metadata operation unit 142a can calculate the hash value of the structured string, the string length, and the number of each character of the string , And the storage unit 142b may store the computed metadata.

The first filter 142c can receive the structured character string through the character string conversion unit 141. [ The first filter 142c determines whether or not the inputted string is identical to the string of the malicious codes stored in the malicious code database 150. The malicious code stored in the malicious code database 150 ) Can be filtered. At this time, the first filter 142c may use a hash value to determine whether or not the character string is the same. Since the first filter 142c filters a character string using an identical character, the first filter 142c may be called an identical character filter.

Hereinafter, the operation of the first filter 142c will be described in detail.

In the apparatus 100 for analyzing a malicious code based on the degree of similarity according to an embodiment of the present invention, the structured string is represented by x through the string conversion unit 141, and the malicious code stored in the malicious code database 150 The first filter 142c can filter the string x having the same hash value as the string y among the input strings. That is, the first filter 142c may filter the character string x having the same hash value as the character string y among the inputted strings, and output the remaining characters.

When the hash values of the structured character string are calculated through the metadata operation unit 142a, the first filter 142c may request the malicious code database 150 for a string having the same hash value as the calculated hash value. If it is confirmed that the same character string as the requested character string exists in the malicious code database 150, the requested character string can be filtered by the first filter 142c. If the strings are equal to each other, the degree of similarity can be 1. The first filter 142c may filter a character string having a similarity of 1. [

5 is a diagram for explaining a process of filtering by a first filter of an apparatus for analyzing malicious code based on the degree of similarity according to an embodiment of the present invention.

As shown in FIG. 5, the same strings as the structured string BR exist in the malicious code database 150, and they can be filtered by the first filter 142c. If the string having the similarity of 1 is filtered, the number of times the structured string is compared with the string stored in the malicious code database 150 may be reduced from 32 to 21.

The second filter 142d may filter the strings stored in the malicious code database 150 and the strings that differ by a predetermined length difference from the strings output by the first filter 142c. That is, the second filter 142d may use the length of the string to filter the input character string. Since the second filter 142d filters the character string using the character length, it may be called a length filter.

Hereinafter, the operation of the second filter 142d will be described in detail.

For the strings x and y, the filtering condition of the second filter 142d may use the following formula (1).

[Equation 1]

if len (x) ≥len (y ), V threshold * len (x)> len (y)

if len (y) ≥len (x ), V threshold * len (y)> len (x)

(len (x) is the length of the string x, len (y) is the length of the string, and V _threshold is the similarity reference value (0.9 in one embodiment of the invention)

6 is a diagram for explaining a process of filtering by a second filter of an apparatus for analyzing malicious code based on the degree of similarity according to an embodiment of the present invention.

As shown in FIG. 6, if a string that differs from the structured string BSSS by more than a predetermined length exists in the malicious code database 150 (string BSSSWBRR and string BS), they can be filtered by the second filter 142d have. When these strings are filtered, the number of times the structured string is compared with the string stored in the malicious code database 150 may be reduced from 21 to 15.

The following is a description of filtering through Equation (1).

The string BSSS (string x) and the string BS (string y) are for if len (x) ≥len (y) and V _threshold * len (x)> len (y). Therefore, when the string BSSS and the string BS are applied to the first case of Equation (1), 0.9 * 4 = 3.6 > 2. This satisfies the filtering condition, and thus the string BSSS and the string BS can be filtered by the second filter 142d.

The string BSSS (string x) and the string BSSSWBRR (string y) are for if len (y) ≥len (x) and V _threshold * len (y)> len (x). Therefore, when the string BSSS and the string BSSSWBRR are applied to the second case of Equation (1), 0.9 * 8 = 7.2 > 4. This satisfies the filtering condition, so that the string BSSS and the string BSSSWBRR can be filtered by the second filter 142d.

The third filter 142e is a filter that stores, among the strings output by the second filter 142d, strings having the sum of the differences between the strings stored in the malicious code database 150 and the numbers of characters constituting the strings, Can be filtered. The third filter 142e may be referred to as a character frequency filter because it filters the character string using the character feature frequency.

Hereinafter, the operation of the third filter 142e will be described in detail.

For the strings x and y, the filtering condition of the third filter 142e may use the following formula (2).

&Quot; (2) "

(len (x) is a string x length, len (y) is long, V _threshold of the string is similarity based on the value (one embodiment of the present invention clerical script is 0.9), ci is a character, freq _x (ci) that make up the string Is the frequency of ci in string x, and freq _y (ci) is the frequency of ci in string y)

7 is a diagram for explaining a process of filtering by a third filter of an apparatus for analyzing malicious code based on the degree of similarity according to an embodiment of the present invention.

As shown in FIG. 7, a string in which the sum of the differences between the structured string BSSS (string x) and the number of characters is equal to or more than a predetermined value exists in the malicious code database 150 (string BBBR) Gt; 142e. ≪ / RTI > The third filter 142e may compare each of the structured strings and each of the strings existing in the malicious code database 150 to perform the comparison. When these strings are filtered, the number of times the structured string is compared with the string stored in the malicious code database 150 may be reduced from 15 to 6.

The following is a description of filtering through Equation (2).

(X) is 4, len (y) is 4, freq _x (B) = 1, freq _x (S) = 3 and freq _x (W) = 0, since the string x is BSSS and the string y is BBBR. freq _y (R) = 0, freq _y (B) = 3, freq _y (S) = 0, freq _y (W) = 0 and freq _y (R) = 1. Thus, since (4 + 4 - 6) / (2 * 4) = 0.25 <0.9, BBBR as string y can be filtered in relation to BSSS which is string x.

The string similarity measuring unit 142f can measure the similarity of the string x and the string y output by the third filter 142e. For example, the similarity degree between the character string x and the character string y can be measured using [Equation 3].

&Quot; (3) &quot;

Wed = 1 - ed (x, y) / max (len (x), len (y)

(Wed is the similarity between the string x and the string y, len (x) is the length of the x string, len (y) is the length of the y string, and ed (x, y) x Minimum number of modifications needed to make the string equal to the y string (insert, delete, replace character)

Ed (x, y) is the edit distance between the string x and the string y, and the string x and the string y are different from each other, and the string x is required to be equal to the string y. The minimum number of modifications (insertion, deletion, character replacement) means.

ed (x, y) can be measured using the following equation (4).

&Quot; (4) &quot;

According to Equation (4), the minimum number of correction times required to make the string x equal to the string y can be measured.

8 is a view for explaining a process of measuring the edit distance.

As shown in Fig. 8, when each row and column of the character string ABC and the character string y is compared, it can be seen that ed (x, y) is finally "1".

As described above, in the apparatus 100 for analyzing malicious codes based on the degree of similarity according to an exemplary embodiment of the present invention, the first filter 142c extracts a character string stored in the malicious code database 150 And the second filter 142d and the third filter 142e may filter the strings that are very similar to the strings stored in the malicious code database 150 among the input strings. Then, the string similarity measurement unit 142f measures the similarity only to the strings that are not filtered by the first filter 142c, the second filter 142d, and the third filter 142e.

9 is a diagram showing a character string for measuring the similarity in an apparatus for analyzing malicious code based on the similarity according to an embodiment of the present invention. As shown in FIG. 9, according to the apparatus 100 for analyzing malicious codes based on the degree of similarity according to an embodiment of the present invention, the string for measuring the degree of similarity can be reduced from 32 to 6 times.

That is, according to the apparatus 100 for analyzing a malicious code based on the degree of similarity according to an embodiment of the present invention, the number of strings for measuring the similarity degree is reduced, and accordingly, the processing speed can be improved.

Since the first filter 142c filters the same character string as that stored in the malicious code database 150, the first filter 142c requires the least computation time. Therefore, it can be performed first in the process of filtering the strings inputted to the string similarity measuring unit 142f. Since the second filter 142d and the third filter 142e have a relationship in which the third filter 142e includes the second filter 142d and the calculation time of the second filter 142d is small, 2 filter 142d can be preferentially performed. The first filter 142c may be applied independently of the second filter 142d and the third filter 142e. The first filter 142c to the third filter 142e are all used in the apparatus 100 for analyzing malicious code based on the degree of similarity according to the embodiment of the present invention. However, the first filter 142c to the third filter 142c, And at least one of the first electrode 142e and the second electrode 142e may be used.

The malicious code similarity measuring unit 142g can measure the similarity of the malicious code based on the string similarity measured by the string similarity measuring unit 142f. The malicious code similarity measuring unit 142g may measure the similarity between the character string x and the character string y, and then measure the malicious code similarity by integrating the measured values.

The similarity of malicious code A to malicious code B can be measured using the following equation (5).

&Quot; (5) &quot;

(S and _A is the degree of similarity is the infection A to B infection, Wed _i is the degree of similarity between the string and the string x _i y _i, weightx _i is the weight of the string x _i, t is a similarity threshold (the In an embodiment of the invention 0.9)))

Malicious code A can consist of a number of strings, which can be a set of strings x _i . And each string has a weight proportional to the length of the string, which can be expressed as weightx _i . The degree of similarity (S _A ) of malicious code A to malicious code B can be measured by measuring the degree of similarity with respect to the string x _i constituting malicious code A and summing them. In addition, the degree of similarity (S _B ) of malicious code B to malicious code A can be measured by applying [Equation 5]. That is, the similarity degree of the string y _i constituting the malicious code B and the weighty _i of the string y _i Can be measured. The final degree of similarity (S _AB ) between malicious code A and malicious code B is calculated by the following equation (6): malicious code A has similarity (S _A ) to malicious code B and malicious code B has malicious code A (S _B ) for a given sample.

&Quot; (6) &quot;

S _{AB =} S _A * S _B

The malicious code discrimination section 143 can discriminate whether or not the program estimated by the malicious code is a malicious code based on the similarity degree of the malicious code measured through the similarity degree measurement section 142. [

As described above, according to the apparatus 100 for analyzing malicious codes based on the degree of similarity according to the embodiment of the present invention, the strings that do not require similarity measurement are filtered through the first filter 142c to the third filter 142e , The number of strings for measuring the degree of similarity can be reduced, and accordingly, the processing speed can be improved.

The method according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

110: Unpacking part
120: Code extracting unit
130: Decompiler
140: Code analysis section
141: String conversion unit
142:
142a: metadata operation unit
142b:
142c: first filter
142d: second filter
142e: third filter
142f: a string similarity measuring unit
142g: malicious code similarity measuring unit
143: Malicious code discrimination unit
150: Malicious code database

Claims (5)

A malicious code database storing structured strings of malicious codes;
An unpacking unit for unpacking a program estimated to be malicious code;
A code extracting unit for extracting a binary code from the unpacked program;
A decompiler for converting the extracted binary code into another code; And
And converting the converted code into a structured string, determining whether the converted string and the strings stored in the malicious code database are the same by using a hash value, and filtering the same strings to determine whether the program is malicious code And analyzing the malicious code based on the degree of similarity including the code analysis unit for identifying the malicious code. A malicious code database storing structured strings of malicious codes;
An unpacking unit for unpacking a program estimated to be malicious code;
A code extracting unit for extracting a binary code from the unpacked program;
A decompiler for converting the extracted binary code into another code; And
Converts the converted code into a structured string, discriminates a length difference between the converted string and a string stored in the malicious code database, and filters the strings with a predetermined length difference or more to determine whether the program is malicious code An apparatus for analyzing malicious code based on similarity including a code analysis unit. A malicious code database storing structured strings of malicious codes;
An unpacking unit for unpacking a program estimated to be malicious code;
A code extracting unit for extracting a binary code from the unpacked program;
A decompiler for converting the extracted binary code into another code; And
Converting the converted code into a structured string, discriminating a difference between the converted string and the number of characters constituting the string stored in the malicious code database, and determining a character string whose sum of difference of the number of characters is equal to or more than a predetermined value And analyzing the malicious code based on the degree of similarity including a code analysis unit for determining whether the program is a malicious code. 4. The method according to any one of claims 1 to 3,
The code analyzing unit,
A string conversion unit for converting the converted code into a structured string;
A similarity measuring unit for filtering the converted string and the strings stored in the malicious code database according to a predetermined condition and measuring the similarity of the unfiltered strings; And
And a malicious code discrimination unit for discriminating whether the program is a malicious code according to the result of the similarity measurement. delete

Images