KR102031592B1 - Method and apparatus for detecting the malware - Google Patents

Abstract

The present invention relates to a method and apparatus for analyzing malicious code. More specifically, the method for analyzing malicious code according to the present invention obtains a certain number of first data and second data from a user, and the data for analyzing the malicious code from the first data and the second data. Generating each set, each of the data sets including a plurality of symbols arbitrarily listed from the first data or the second data, analyzing a specific characteristic for determining the malicious code among the plurality of symbols, Statistical analysis may be performed to determine whether malicious code is based on the specific characteristic, wherein the first data is data that does not include malicious code, and the second data may be data that includes malicious code.

Description

METHOD AND APPARATUS FOR DETECTING THE MALWARE}

The present disclosure relates to a method and apparatus for detecting malware. More specifically, the present invention relates to a method and apparatus for detecting malicious code using a statistical analysis method.

Conventional malicious code or virus detection is mainly performed based on basic information or patterns of files.

In other words, various basic information to detect malicious code is made into database and based on this, cross-searching information about all files and information stored in database is made to identify whether malicious file is present.

According to the prior art as described above, if the malicious code file has the characteristics, the malicious code can be detected quickly and accurately.

However, if the malicious code file does not possess the characteristics of the malicious file, that is, the unknown malicious code is impossible to detect itself, and even the known malicious code is detected even though the malicious code causes the same harmful behavior even if the variant occurs. Has the disadvantage of being difficult.

Research on static analysis of malware is actively conducted through approaches based on PE and N-gram. However, since malicious code is being developed in a modified form through obfuscation techniques, the existing static code static analysis method is limited, and dynamic analysis has a relatively large overhead.

Therefore, it is necessary to study the static analysis method that is not affected by obfuscation. Accordingly, the present invention proposes an analysis model for detecting malicious code based on a specific symbol through the fact that a certain symbol character appears relatively in obfuscated malware.

The technical problems to be achieved in the present specification are not limited to the technical problems mentioned above, and other technical problems not mentioned above will be clearly understood by those skilled in the art from the following description. Could be.

The method for analyzing malicious code according to the present invention includes obtaining a specific number of first data and second data from a user; Generating a data set for analyzing the malicious code from the first data and the second data, respectively, each of the data sets including a plurality of symbols arbitrarily listed from the first data or the second data; ; Analyzing a specific characteristic for determining the malicious code among the plurality of symbols; And performing statistical analysis to determine whether malicious code is based on the specific characteristic, wherein the first data is data that does not include malicious code, and the second data is data that includes malicious code. .

In addition, the present invention, the input unit for obtaining a specific number of first data and the second data from the user; A data processor for generating a data set for analyzing the malicious code from the first data and the second data, each of the data sets including a plurality of symbols arbitrarily listed from the first data or the second data and; An analysis unit for analyzing a specific characteristic for determining the malicious code among the plurality of symbols; And a determining unit configured to perform statistical analysis for determining whether the malicious code is based on the specific characteristic, wherein the first data is data that does not include malicious code, and the second data is data including malicious code. Provide the device.

According to an embodiment of the present invention, obfuscated malware can be detected through statistical analysis using a specific symbol.

In addition, according to an embodiment of the present invention, by analyzing the frequency of the data not infected with the malicious code and the specific symbol string of the infected data, the malicious code introduced techniques such as malicious code obfuscation, anti-debugging, etc. Can be detected.

Effects obtained in the present specification are not limited to the above-mentioned effects, and other effects not mentioned above may be clearly understood by those skilled in the art from the following description. will be.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are included as part of the detailed description in order to provide a thorough understanding of the present invention, provide examples of the present invention and together with the description, describe the technical features of the present invention.
1 is a diagram illustrating the overall configuration of an apparatus for detecting malicious code proposed herein.
2 is a diagram illustrating a part of an apparatus for detecting malicious code proposed herein.
3 is a diagram illustrating a symbol-based malicious code detection model proposed in the present specification.
4 is a diagram illustrating a method for detecting malicious code based on a symbol proposed in the present specification.
5 is an example of a graph for comparing the number of strings of malicious code proposed in the present specification.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to be limited to the particular embodiment of the present invention, it should be understood to include all transformations, equivalents, and substitutes included in the spirit and scope of the present invention. In the following description of the present invention, if it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Due to the fact that most malicious codes are composed of binary files, various approaches for static analysis of malicious codes based on binary files have been studied.

For example, there is a system for analyzing malicious code such as a static analysis system that extracts a static dependency tree by analyzing hierarchical dependencies between the PE format and the DLL.

However, this malicious code static analysis has a problem that must solve the packing or obfuscation. Accordingly, the present invention proposes a symbol-based malware analysis model for solving the problem of packing or obfuscation.

1 is a diagram illustrating the overall configuration of an apparatus for detecting malicious code proposed herein.

The apparatus 100 for measuring malicious code based on a symbol may include an input unit 110, a storage unit 120, a control unit 130, and / or an output unit 140.

Since the components shown in FIG. 1 are not essential, an electronic device having more or fewer components may be implemented.

Hereinafter, the components will be described in order.

The input unit 110 may generate input data for the operation of the device by the user, and may receive a sample file for the symbol-based malicious code detection model from the user. The input data may be a binary file.

For example, the input unit 110 may receive various sample files for a symbol-based malicious code detection model, which will be described later.

The storage unit 120 may store a program for the operation of the controller 130 and may temporarily store input / output data. Sample files for symbol-based malware detection models can be saved from users, and the analysis results of malware can be saved.

The storage unit 120 may include a flash memory type, a hard disk type, a multimedia card micro type, and a card type memory (for example, SD or XD memory). RAM, Random Access Memory (RAM), Static Random Access Memory (SRAM), ReadOnly Memory (ROM), Electrically Erasable Programmable ReadOnly Memory (EEPROM), Programmable ReadOnly Memory (PROM) magnetic memory, magnetic disk, optical disk It may include one type of storage medium.

The apparatus for detecting malicious codes may operate in association with a web storage that performs a storage function of the storage 120 on the Internet.

The controller 130 typically controls the overall operation of the device.

For example, the controller 130 may generate a data set by analyzing sample files input from a user, and analyze a symbol characteristic for detecting malicious code based on the generated data set.

In addition, the controller 130 may determine whether the data input through the statistical analysis is malicious code using the analyzed symbol characteristics.

The output unit 140 is for generating output related to time, hearing, and the like, and outputs information processed by the apparatus 100.

For example, the controller 130 may output the number of character strings for a specific symbol processed in a graph format, and may output whether the input data is malicious code.

2 is a diagram illustrating a part of an apparatus for detecting malicious code proposed herein.

Referring to FIG. 2, the controller 130 may include a data processor 132, an analyzer 134, and / or a determiner 136 to detect malicious code based on a specific symbol.

The components shown in FIG. 2 are not essential, so that an electronic device having more or fewer components may be implemented.

The data processor 132 may select a plurality of symbol characters for analyzing a malicious code from data input through the input unit 110, and list the selected plurality of symbol characters.

In this case, the plurality of symbol characters for analyzing the malicious code may mean special character symbols such as @, +, and * generated by the static analysis of the malicious code. Thus, the symbol character may mean a special character.

In addition, the data processor 132 may extract or generate a data set for the input data by extracting the number of symbol strings including each of the listed symbol characters.

The analyzer 134 may classify the number of character strings included in the data set extracted or generated by the data processor 132 into a specific range, and analyze the number of files corresponding to each range according to a symbol.

In addition, the analysis unit 134 compares the number distribution of the normal data and the malicious code data according to the symbol based on the analysis result, and the set of symbols in which the number of the general data and the malicious code data differs by a predetermined number or more according to the number distribution May be determined as a symbol characteristic for discriminating malicious code.

The determination unit 136 may determine the malicious code through statistical analysis using the symbol characteristics determined by the analysis unit 134.

For example, the determination unit 136 may select an independent variable and a dependent variable to determine malicious code, and determine the malicious code by applying the selected independent variable and the dependent variable to a logistic regression analysis.

In this case, the independent variable refers to one of the specific character symbols included in the symbol characteristic determined by the analyzer 134, and the dependent variable refers to a variable for determining whether the input data is malicious code.

For example, through the logistic regression analysis, if the value of the dependent variable of the input data is '0', it may be determined as normal data, and if it is '1', it may be determined as malicious code.

By using the above method, the controller 130 may generate a symbol-based malicious code static analysis model, and determine whether the input data is malicious code through the generated malicious code static analysis model to determine the output unit 140. You can output it through

3 is a diagram illustrating a symbol-based malicious code detection model proposed in the present specification.

Referring to FIG. 3, a symbol-based malicious code detection model may be generated by inputting a specific number of malicious codes and normal data as samples. Hereinafter, the specific method will be described.

1. Input sample file

N samples of normal binary data (first data) and malware binary data (second data) for generating a symbol-based malicious code detection model are obtained from a user. In this case, the binary data may mean a binary file.

2. Extract Dataset

Thereafter, a data set is extracted or generated from the n input first data and the second data, respectively.

First, a plurality of random symbols to be analyzed are selected to determine malicious code, and a plurality of selected random symbols are listed.

Each data set is extracted or generated by extracting the number of symbol strings each including a plurality of arbitrary symbols listed in each of the first data and the second data.

3. Feature Analysis

Then, specific characteristics are analyzed to distinguish normal data from data including malicious codes from each extracted data set.

 Specifically, the number of symbol strings that are nonlinear values are classified into specific ranges, and the number of first data and second data corresponding to each classified range is analyzed for each symbol.

Subsequently, the number distribution of the first data and the second data according to the symbol is compared based on the analysis result, and as a result of the comparison, the number of symbols having a difference between the number of the first data and the number of the second data is selected.

The symbols thus selected may be selected as symbol characteristics for discriminating malicious codes.

The data set extracted or generated in step 2 based on a specific range for the selected symbol characteristic may be processed or processed.

For example, the number of symbol strings for each data of the data set extracted or generated in step 2 may be converted into an intermediate value of each specific range. This transformation can convert the data output as non-linear values into categorical data, thereby increasing the efficiency of statistical analysis.

4. Statisticals Analysis

Malicious code analysis can be used for various machine learning based analysis. Machine learning or machine learning is an area of artificial intelligence that means the development of algorithms and technologies that enable computers to learn.

Accordingly, logistic regression analysis can be used for statistical analysis of the data set processed or processed in step 3.

First, independent variables and dependent variables applied to logistic regression analysis may be selected to determine data including malicious code using logistic regression analysis.

In this case, the independent variable refers to one of a plurality of symbols included in a symbol characteristic used to determine malicious code, and the dependent variable indicates whether the data to be determined as data of the independent variable includes malicious code. It can mean a variable.

That is, whether the data input through the probability calculation from the data (for example, the symbol occurrence frequency, etc.) of the symbol characteristic as an independent variable is normal or malicious code is indicated through the dependent variable.

Thereafter, the selected independent variable, dependent variable, and processed data may be applied to logistic regression analysis to determine whether each input data is normal or malicious.

For example, if the dependent variable outputted as a result of specific input data analyzed through logistic regression is '0', the specific input data is normal data, and if '1', it is data containing malicious code. Can be.

Through this symbol-based malicious code discrimination model, it is possible to determine whether or not obfuscated data contains malicious code.

4 is a diagram illustrating a method for detecting malicious code based on a symbol proposed in the present specification.

Specifically, the obfuscated malicious code may be determined by generating a symbol-based malicious code discrimination model through data including n normal data and malicious code, respectively.

Specifically, in order to generate a malicious code discrimination model, the device obtains a specific number of normal binary data (first data) and malicious code binary data (second data) from the user (S4010).

Thereafter, a data set for analyzing the malicious code is generated from the first data and the second data, respectively (S4020).

In this case, each data set may be generated by the same method as step 2 described in FIG. 3, and may include a plurality of symbols arbitrarily listed from the first data or the second data.

Thereafter, the device analyzes a specific characteristic for determining the malicious code among a plurality of symbols included in each data set (S4030).

At this time, the analysis of the specific characteristics may be analyzed through the same method as step 3 described in FIG.

Thereafter, the device may perform a statistical analysis to determine whether the malicious code is based on the specific characteristic to determine whether the input data includes the malicious code (S4040).

At this time, statistical analysis for determining whether the malicious code may be performed through the same method as step 4 described in FIG.

Experimental results and analysis to determine malicious code

5 is an example of a graph for comparing the number of strings of malicious code proposed in the present specification.

FIG. 5 illustrates a distribution difference for a specific symbol of a data set of data including normal data and malicious code when 1000 pieces of data including normal data and malicious code are used.

Specifically, 1000 pieces of data including normal data and malicious code are input as sample data, and the tool of Table 1 is used for symbol string extraction, data set extraction, and statistical analysis.

process tool Extract symbol string Strings Extract data set C-based program implementation Statistical analysis SPSS

First, for symbol characterization, the number of symbol strings of the extracted data set described in FIG. 3 is classified into an arbitrary range, and the distribution difference between normal data and data including malicious code is compared based on the classified range. do.

For example, the result for the character symbol '+' may be as shown in FIG. 5.

In FIG. 5, the x-axis is the range of the number of classified symbol strings and the y-axis is the number of files.

In this case, a symbol having a large difference in the distribution result between the normal data and the data including malicious code may be selected as a symbol characteristic to distinguish between normal data and malicious data including normal data and malicious code.

In addition, by converting the symbol string number data of the existing data set into an intermediate value of the classified range, the existing data set may be processed for each symbol characteristic.

Subsequently, statistical analysis can be performed by applying the processed data set to logistic regression as a result of analyzing the symbol characteristics.

In this case, the statistical analysis may be a statistical package for social science (SSSS) statistical analysis tool.

Malicious code was detected using statistical analysis of 1000 samples of data including normal data and malicious code, and the detection rate was 87.6%.

In addition, only 10.6% of malicious data were detected as malicious code. Statistical analysis results are shown in Table 2 below.

Malware detection rate Normal false rate 87.6% 10.6%

Referring to Table 2, it can be seen that the model that statistically determines the malicious code based on the frequency of the string including the specific symbol can determine the malicious code with a high probability.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

Further, for convenience of description, the drawings are divided and described, but it is also possible to design a new embodiment by merging the embodiments described in each drawing.

In addition, the present invention described above can be embodied as computer readable codes on a medium on which a program is recorded. The computer-readable medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable media include hard disk drives (HDDs), solid state disks (SSDs), silicon disk drives (SDDs), ROMs, RAMs, CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and the like. It includes. The computer may also include a controller 130 of the device. Accordingly, the above detailed description should not be construed as limiting in all aspects and should be considered as illustrative. The scope of the invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the invention are included in the scope of the invention.

100: device 110: input unit
120: storage unit 130: control unit
140: output unit

Claims (10)

In the method for analyzing malicious code performed in the device for analyzing malicious code,
Obtaining a specific number of first data and second data from a user;
Generating a data set for analyzing the malicious code from the first data and the second data, respectively;
Each of the data sets comprises a plurality of symbols arbitrarily listed from the first data or the second data;
Analyzing a specific characteristic for determining the malicious code among the plurality of symbols; And
Performing statistical analysis to determine whether malicious code is based on the specific characteristics,
The first data is data that does not contain malicious code,
And said second data is data comprising malicious code.
The method of claim 1, wherein the generating of each data set comprises:
Selecting the plurality of symbols;
Listing the selected plurality of symbols; And
Extracting a number of character strings each of the plurality of symbols from each of the first data and the second data,
And the data set is generated based on the number of the character strings.
The method of claim 2, wherein analyzing the specific property comprises:
Classifying the number of strings extracted from each of the first data and the second data into a specific range; And
The method may further include selecting at least one symbol of the plurality of symbols, wherein the number difference between the first data and the second data included in the specific range is a predetermined number or more,
And wherein said particular characteristic consists of said at least one symbol.
The method of claim 1,
Wherein said statistical analysis is performed using a logistic regression analysis.
The method of claim 4, wherein performing the statistical analysis comprises:
Selecting independent and dependent variables to use the logistic regression analysis; And
Applying the selected independent variable and the selected dependent variable to the logistic regression analysis,
The independent variable represents a specific symbol for analyzing the malicious code,
The dependent variable is a method for analyzing malicious code that is a variable indicating whether or not malicious code.
In the device for analyzing malicious code, the device,
An input unit for obtaining a specific number of first data and second data from a user;
A data processor which generates a data set for analyzing the malicious code from the first data and the second data, respectively;
Each of the data sets comprises a plurality of symbols arbitrarily listed from the first data or the second data;
An analysis unit for analyzing a specific characteristic for determining the malicious code among the plurality of symbols; And
It includes a determination unit for performing a statistical analysis for determining whether malicious code based on the specific characteristics,
The first data is data that does not contain malicious code,
And said second data is data comprising malicious code.
The method of claim 6, wherein the data processing unit,
Select the plurality of symbols,
Listing the selected plurality of symbols,
Extracting a number of character strings each of the plurality of symbols from each of the first data and the second data,
And the data set is generated based on the number of the strings.
The method of claim 7, wherein the analysis unit,
Classify the number of strings extracted from each of the first data and the second data into a specific range,
At least one symbol having a number difference between the first data and the second data included in the specific range among the plurality of symbols is a predetermined number or more,
The specific characteristic consists of the at least one symbol.
The method of claim 6,
Wherein said statistical analysis is performed using logistic regression analysis.
The method of claim 9, wherein the analysis unit,
Select independent and dependent variables to use the logistic regression analysis,
Apply the selected independent variable and the selected dependent variable to the logistic regression analysis,
The independent variable represents a specific symbol for analyzing the malicious code,
The dependent variable is a device indicating whether or not malicious code.