KR102161233B1 - Apparatus and method for classifying malicious code data - Google Patents

Abstract

The present disclosure relates to an apparatus and method for classifying a group of variant malicious codes. The present disclosure discloses a method of generating a one-dimensional vector by converting binary information corresponding to each section code included in the malicious code data, and converting a finite signal into a frequency domain by considering the one-dimensional vector as a finite signal. In addition, a method of extracting a feature point based on the strength of a signal component for each frequency in a frequency domain and classifying a variant malicious code group based on the extracted feature point is disclosed.

Description

Device and method to classify malicious code data {APPARATUS AND METHOD FOR CLASSIFYING MALICIOUS CODE DATA}

The present disclosure provides an apparatus and method for classifying malicious code data.

Recently, cyberspace has become so important that it is mentioned as the fourth battlefield. Cyber warfare is a part where a lot of effort is being made not only in the powerful countries but also in countries with low traditional military power. In particular, APT (Advanced Persistent Threat) attacks targeting a specific country or group are becoming more damaging than the effects of traditional weapons.

Malicious codes used for APT attacks are sometimes created, but since it takes a lot of manpower and goods to create new malicious codes, malicious codes are often produced in a module format. Malware in the form of a module is frequently reused, and experts can identify attack groups by analyzing the similarity of code fragments. Although code similarity does not necessarily mean that attack groups are identical, code similarity can be used as an auxiliary indicator.

Conventionally, research has been actively conducted to classify variants of malicious codes using code similarity. For example, based on the size of the malicious code, after converting the malicious code into a two-dimensional image close to a rectangle, GIST feature points related to the texture of the image are extracted, and the extracted feature points have been used for classification of the malicious code. By implementing the malicious code as a two-dimensional image in this way, it was possible to classify the malicious code by applying an image processing technique to the two-dimensional image, but when i is the actual malicious code array axis and j is the artificially created axis, Img(i, There is no correlation between j) and Img(i,j+1).

Accordingly, there is a need for a technique for classifying a group of variant malicious codes without converting the malicious code into a two-dimensional image.

It is to provide an apparatus and method for classifying malicious code data. Further, it is to provide a computer-readable recording medium in which a program for executing the method on a computer is recorded. The technical problem to be achieved by this embodiment is not limited to the technical problems as described above, and other technical problems may be inferred from the following embodiments.

As a technical means for achieving the above-described technical problem, a first aspect of the present disclosure provides a method for classifying a group of malicious codes, the method comprising: receiving malicious code data; Separating the malicious code data for each section code; Converting binary information corresponding to each of the section codes to generate a one-dimensional vector; Considering the generated one-dimensional vector as a finite signal and converting the finite signal into a frequency domain; Extracting feature points based on the strength of each frequency signal component in the frequency domain; And classifying the malicious code data into a specific malicious code group based on the extracted feature points.

In addition, a method comprising: generating a one-dimensional vector by converting binary information corresponding to an opcode among binary information corresponding to each of the section codes may be provided.

In addition, inputting the extracted feature points to a model trained by applying a machine learning technique; And classifying the malicious code data into a specific malicious code group by driving the model.

In addition, it is possible to provide a method in which the learned model is a gradient boosting model.

In addition, it is possible to provide a method including a step of preventing overfitting by applying a bagging (Bootstrap Aggregating) algorithm to the extracted feature points.

In addition, a method comprising: transforming the finite signal into the frequency domain by applying a discrete cosine transform may be provided.

In addition, a method comprising: transforming the finite signal into the frequency domain by applying a Discrete Fourier Transform may be provided.

In addition, the finite signal is obtained by applying at least one of Cosine Transform, Fourier Transform, Short-Time Fourier Transform, Har transform, and Wavelet Transform. It may provide a method comprising a; converting into the frequency domain.

In addition, a method including: removing a DC component from the converted frequency domain and removing some of data in a low frequency domain may be provided.

In addition, the malicious code data may be provided in an assembler (ASseMbler, ASM) file format or a bytes file format.

A second aspect of the present disclosure includes: a storage unit for storing at least one program; A communication unit for receiving malicious code data; And at least one processor for classifying malicious code data by executing the at least one program, wherein the storage unit comprises: separating, by the at least one processor, the malicious code data for each section code; Converting binary information corresponding to each of the section codes to generate a one-dimensional vector; Considering the generated one-dimensional vector as a finite signal and converting the finite signal into a frequency domain; Extracting feature points based on the strength of each frequency signal component in the frequency domain; And classifying the malicious code data into a specific malicious code group based on the extracted feature points. The apparatus may be provided, comprising instructions for executing.

A third aspect of the present disclosure may provide a computer-readable recording medium in which a program for executing the method of the first aspect on a computer is recorded.

According to the present invention, malicious code data is represented in a frequency domain, feature points can be extracted based on the strength of signal components for each frequency, and malicious code data belongs to a certain malicious code group based on the feature points of the malicious code data. Whether or not can be effectively identified.

1 is a flowchart of a method of classifying malicious code data according to an exemplary embodiment.
FIG. 2 is a diagram illustrating an example of converting a 1D vector representing malicious code data into a frequency domain, according to an exemplary embodiment.
FIG. 3 is a diagram for explaining an example of extracting feature points of malicious code data based on opcodes included in binary information of malicious code data according to an embodiment.
4 is a diagram for explaining an example of applying a bagging algorithm to a feature point according to an embodiment.
5 is a block diagram of an apparatus for classifying a malicious code according to an embodiment.

Phrases such as "in some embodiments" or "in one embodiment" appearing in various places in this specification are not necessarily all referring to the same embodiment.

Some embodiments of the present disclosure may be represented by functional block configurations and various processing steps. Some or all of these functional blocks may be implemented with various numbers of hardware and/or software components that perform specific functions. For example, the functional blocks of the present disclosure may be implemented by one or more microprocessors, or may be implemented by circuit configurations for a predetermined function. In addition, for example, the functional blocks of the present disclosure may be implemented in various programming or scripting languages. The functional blocks may be implemented as an algorithm executed on one or more processors. In addition, the present disclosure may employ conventional techniques for electronic environment setting, signal processing, and/or data processing. Terms such as “mechanism”, “element”, “means” and “composition” can be used widely, and are not limited to mechanical and physical configurations. In addition, “… Wealth”, “… The term “module” refers to a unit that processes at least one function or operation, which may be implemented as hardware or software, or a combination of hardware and software.

In addition, the connecting lines or connecting members between the components illustrated in the drawings are merely illustrative of functional connections and/or physical or circuit connections. In an actual device, connections between components may be represented by various functional connections, physical connections, or circuit connections that can be replaced or added.

Hereinafter, the present disclosure will be described in detail with reference to the accompanying drawings.

1 is a flowchart of a method of classifying malicious code data according to an exemplary embodiment.

Referring to FIG. 1, in step 110, the apparatus for classifying malicious code may receive malicious code data from the outside.

In addition to the existing malicious code, malicious code data may include variant malicious code. Variant malicious code can be generated by applying the following various techniques.

Variant malware can be generated by obfuscation techniques, and obfuscation techniques include dead code insertion, register reassignment, subroutine reordering, and instruction replacement. substitution), code transportation, code integration, and the like.

In an embodiment, the malicious code data may be in an assembler (ASseMbler, ASM) file format or a bytes file format. The ASM file is a file that stores the contents of the actual malicious code read in the IDA (Interactive DisAssembler) program in text format, and the bytes file is a file whose header has been removed to prevent abuse.

The following data analysis results used a Malware dataset provided by Microsoft that was uploaded to the Kaggle site (https://www.kaggle.com/c/malware-classification/data). The Malware dataset provides 10,868 malware labeled 9 variants in both ASM files and bytes.

In step 120, the malicious code classification apparatus may separate malicious code data for each section code.

In one embodiment, the section code may include .idata, .data, .text, .rdata, .rsrc, .reloc, and .bss, but is not limited thereto. For example, .idata is a section containing IAT-related information, .text is a section containing program code-related information, and a section containing relocate information of a .reloc PE file.

The malicious code classification apparatus may separate the byte file for each section code based on address information included in the ASM file. Basically, since there is no header in the byte file, it may be difficult to separate the section code using only the byte file. Since the ASM file has a specification for each section, the section code can be separated by using the address information included in the ASM file.

As a result of separating malware included in the Malware dataset by section code, the section codes with the largest number are shown in Table 1 below.

Section Name Frequency .idata 10,339 .data 10,295 .text 10,289 .rdata 9,255 .rsrc 6,271 .reloc 2,299 .bss 1,047

In step 130, the malicious code classification apparatus may generate a one-dimensional vector by converting binary information corresponding to each section code.

Binary information may correspond to each section code separated from malicious code data. Binary information may be composed of a plurality of bytes, and 1 byte may have a range of 0 to 255.

The malicious code classification apparatus can generate a one-dimensional vector by directly converting each of a plurality of bytes constituting the binary information into a numeric value without using a specific table in converting binary information corresponding to each section code. For example, the malicious code classification apparatus may generate a one-dimensional vector by converting each of a plurality of bytes corresponding to a specific section code into a binary number.

At this time, in the case of a character that cannot be interpreted by IDA among malicious code data, it may be indicated as “??”. The malicious code classification device converts the character indicated by “??” to 0 or 255, or deletes the one-dimensional vector. Can be generated.

In step 140, the malicious code classification apparatus may regard the generated 1D vector as a finite signal, and may convert the finite signal into a frequency domain.

The malicious code classification apparatus may convert the finite signal into the frequency domain by considering the one-dimensional vector generated in step 130 as a finite signal and applying a Cosine Transform or Discrete Cosine Transform.

For example, when a one-dimensional vector is a finite signal x(t), it can be expressed as Equation 1 below by applying a cosine transform to x(t).

Meanwhile, from the frequency domain X(ξ) of x(t) calculated through Equation 1, the DC component representing the background signal may be removed. In addition, among the frequency domain X(ξ), some of data in the low frequency domain may be removed. In this case, the malicious code classification apparatus may remove a predetermined percentage (α%) of data in a low frequency region. Through this, it is possible to increase the accuracy of the result of classifying the variant malicious code group.

In addition, the malicious code classification apparatus may convert the finite signal into a frequency domain by considering the one-dimensional vector generated in step 130 as a finite signal and applying Fourier Transform or Discrete Fourier Transform.

For example, when a one-dimensional vector is a finite signal x(t), it can be expressed as Equation 2 below by applying a Fourier transform to x(t).

Meanwhile, in the case of the frequency domain X(ξ) of x(t) calculated through Equation 2, since an imaginary part also exists, a real part, an imaginary part, a size and an angle may be extracted as a domain.

In one embodiment, the malware classification apparatus may consider a one-dimensional vector as a finite signal and apply a cosine transform (or discrete cosine transform) and a Fourier transform (or discrete Fourier transform) to the legacy signal, and as a result, the cosine In step 160, a feature point may be extracted for a total of five domains: signal strength in the frequency domain in the transform, real part, imaginary part, magnitude, and angle value in the Fourier transform.

The malware classification apparatus considers the one-dimensional vector generated in step 130 as a finite signal, and uses a Cosine Transform, Fourier Transform, Short-Time Fourier Transform, and Har transform. ) And a wavelet transform (Wavelet Transform) may be applied to transform the finite signal into the frequency domain, but is not limited thereto.

In step 150, the apparatus for classifying a malicious code may extract a feature point based on the strength of a signal component for each frequency in the frequency domain. Step 150 will be described later in FIG. 2.

In step 160, the malicious code classification apparatus may classify the malicious code data into a specific malicious code group based on the extracted feature points.

Malicious code data having similar codes or functions may belong to the same malicious code group. The malicious code classification apparatus may use the characteristic points of the newly received malicious code data to determine whether to classify the newly received malicious code data into which malicious code group among the existing malicious code groups.

First, the malicious code classification apparatus may perform learning by matching a feature point for specific malicious code data and a malicious code group to which the specific malicious code data belongs using a machine learning technique.

In one embodiment, the malware classification apparatus may perform learning by inputting feature points for specific malware data into a gradient boosting model, and previously received or newly received malware data based on the learning result. Can be classified into specific malicious code groups.

The malicious code classification apparatus may classify newly received malicious code data into a specific malicious code group by inputting newly received malicious code data into the learned model.

According to the present invention, it is possible to convert malicious code data into a frequency domain, extract feature points based on the strength of signal components for each frequency, and classify malicious code data into specific malicious code groups based on the extracted feature points. Through this, in addition to being able to classify which malicious code group the existing malicious code belongs to, various techniques for bypassing malicious code detection are applied to create variants, i.e., to which malicious code group the transfer malicious code belongs. It can be effectively classified as well.

FIG. 2 is a diagram illustrating an example of converting a 1D vector representing malicious code data into a frequency domain, according to an exemplary embodiment.

Referring to FIG. 2, each section code included in malicious code data may have an address 210. For example, '10004000' representing the address 210,… , '10004040' may each be an address 210 corresponding to one section code.

Each address 210 may store binary information 220 corresponding to the section code, and the malicious code classification apparatus may generate a one-dimensional vector by converting all of a plurality of bytes constituting the binary information 220 . For example, the malicious code classification apparatus may generate a one-dimensional vector by converting byte values 00, 10, and FF into 0, 16, and 255, respectively.

The malicious code classification apparatus may regard a one-dimensional vector as a finite signal, and the finite signal may be displayed as a first graph 230 in a spatial area.

The malicious code classification apparatus may convert a finite signal into a frequency domain by applying a Discrete Cosine Transform to the finite signal, and at this time, calculate a second graph 240 in a frequency domain.

Additionally, the malicious code classification apparatus calculates the third graph 250 by removing the DC component representing the background signal from the second graph 240 and a predetermined percentage (α%) of data in the low frequency region. can do. The malicious code classification apparatus may increase the accuracy of the malicious code classification result by extracting a feature point based on the third graph 250 from which a DC component and a part of data in the low frequency domain have been removed.

The malicious code classification apparatus may extract the feature point 260 based on the strength of the signal component for each frequency in the third graph 250.

In an embodiment, the malicious code classification apparatus may extract a feature name from statistics indicated in Table 2 from the third graph 250. However, the type of feature point is not limited thereto.

The malicious code classification apparatus may classify malicious code data into a specific malicious code group based on the extracted feature points. The extracted feature points can be used as input data for machine learning/deep learning. In an embodiment, the malicious code classification apparatus may perform learning by applying the extracted feature points to a gradient boosting model, and classify newly received malicious code data into a specific malicious code group based on the learning result. have.

3 is a diagram for describing an example of extracting feature points of malicious code data based on opcodes included in binary information of malicious code data according to an exemplary embodiment.

Referring to FIG. 3, each section code 310 included in malicious code data may have an address 320. In addition, binary information 330 may be stored in each address 320.

The binary information 330 may be composed of a plurality of bytes, and some of the bytes constituting the binary information 330 represent instructions of a program. Program instructions are divided into opcode (operator) and operand (address), where opcode represents an operation operation and operand represents the location of data to be operated. For example, '8D 64' of the binary information 330 may correspond to opcode'lea', and '8B' may correspond to opcode'mov'.

The malicious code classification apparatus may generate a one-dimensional vector by converting only the opcode of the binary information 330 instead of using all of the plurality of bytes constituting the binary information 330. For example, the device for classifying malware is section code'. In'text', when the first byte of the instruction is a hexadecimal number, it is determined as an opcode and converted into a two-signal number to generate a one-dimensional vector.

The malicious code classification apparatus may regard the generated one-dimensional vector as a finite signal and convert the finite signal into a frequency domain. The malicious code classification apparatus may convert a finite signal into a frequency domain by considering a one-dimensional vector generated based on an opcode as a finite signal and applying a Cosine Transform or Discrete Cosine Transform.

Also, the malicious code classification apparatus may extract feature points based on the strength of signal components for each frequency in the frequency domain. The malicious code classification apparatus may classify malicious code data into a specific malicious code group based on the extracted feature points.

In the present invention, it is possible to select only an opcode from among binary information on the malicious code data, and extract a feature point for the malicious code data based on bytes corresponding to the opcode. Classification performance can be improved by extracting feature points for malicious code data based on bytes corresponding to opcodes, excluding operands and various metadata among binary information.

4 is a diagram illustrating an example of applying a bagging algorithm to a feature point according to an exemplary embodiment.

The malicious code classification apparatus may generate a one-dimensional vector by converting binary information corresponding to each section code separated from the malicious code data, and convert the finite signal into a frequency domain by considering the one-dimensional vector as a finite signal. Also, the malicious code classification apparatus may extract feature points for malicious code data based on the strength of signal components for each frequency in the frequency domain.

The malicious code classification apparatus may perform learning by matching a feature point for specific malicious code data and a malicious code group to which the specific malicious code data belongs using a machine learning technique.

In one embodiment, the malware classification apparatus may perform learning by inputting feature points for specific malware data into a gradient boosting model, and previously received or newly received malware data based on the learning result. Can be classified into specific malicious code groups.

Specifically, the malicious code classification apparatus may set a feature point for malicious code data as the entire dataset 410 and apply a bagging (Bootstrap Aggregating) algorithm to the entire dataset 410. By applying the bagging algorithm to the entire data set 410, overfitting of the learning result can be prevented.

As a result of applying the bagging algorithm, the malicious code classification device generates a plurality of bootstrap data 420 for the entire dataset 410, and models the generated bootstrap data 420 to generate a plurality of models 430. Can be generated. The malicious code classification apparatus may generate the final learning model 440 by combining the models 430 generated by applying techniques such as “averaging” and “majority voting”.

Meanwhile, the bootstrap data 420 refers to a plurality of sample data having the same size selected from the entire dataset 410 through a simple restoration random sampling method.

5 is a block diagram of an apparatus for classifying a malicious code according to an embodiment.

Referring to FIG. 5, the malicious code classification apparatus 500 may include a control unit 510, a communication unit 520, and a memory 530. In the malicious code classification apparatus 500 shown in FIG. 5, only components related to the embodiment are shown. Therefore, it can be understood by those of ordinary skill in the art that other general-purpose components may be further included in addition to the components shown in FIG. 5.

The communication unit 520 may receive malicious code data. In an embodiment, the malicious code data may be in an assembler (ASseMbler, ASM) file format or a bytes file format.

The memory 530 is hardware that stores various types of data processed in the malicious code classification apparatus 500. For example, the memory 530 may store malicious code data received from the communication unit 520. Also, the memory 530 may store data on a section code, a one-dimensional vector, and a feature point. The memory 530 is a random access memory (RAM) such as dynamic random access memory (DRAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and CD- ROM, Blu-ray or other optical disk storage, hard disk drive (HDD), solid state drive (SSD), or flash memory.

The controller 510 may control a series of processes for classifying a group of variant malicious codes described above in FIGS. 1 to 4. The controller 510 serves to control overall functions for controlling the malicious code classification device 500.

In an embodiment, the controller 510 may generate a one-dimensional vector by separating the malicious code data received from the communication unit 520 for each section code and converting binary information corresponding to each of the section codes. Also, the control unit 510 may regard the generated 1D vector as a finite signal and may convert the finite signal into a frequency domain. The controller 510 may extract a feature point based on the strength of a signal component for each frequency in the frequency domain, and classify a variant malicious code group based on the extracted feature point.

The present embodiments may also be implemented in the form of a recording medium including instructions executable by a computer, such as a program module executed by a computer. Computer-readable media can be any available media that can be accessed by a computer, and includes both volatile and nonvolatile media, removable and non-removable media. Further, the computer-readable medium may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes computer readable instructions, data structures, other data in a modulated data signal such as program modules, or other transmission mechanisms, and includes any information delivery media.

In addition, in the present specification, the “unit” may be a hardware component such as a processor or a circuit, and/or a software component executed by a hardware configuration such as a processor.

The foregoing description of the present specification is for illustrative purposes only, and those of ordinary skill in the art to which the content of the present specification belongs will understand that it is possible to easily transform it into other specific forms without changing the technical spirit or essential features of the present invention. I will be able to. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not limiting. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as being distributed may also be implemented in a combined form.

The scope of the present embodiment is indicated by the claims to be described later rather than the detailed description, and it should be construed that all changes or modified forms derived from the meaning and scope of the claims and their equivalent concepts are included.

Claims (12)

In the method of classifying malicious code data,
Receiving malicious code data;
Separating the malicious code data for each section code;
Converting binary information corresponding to each of the section codes to generate a one-dimensional vector;
Considering the generated one-dimensional vector as a finite signal and converting the finite signal into a frequency domain;
Extracting feature points based on the strength of signal components for each frequency in the frequency domain; And
Classifying the malicious code data into a specific malicious code group based on the extracted feature points;
Including,
The step of generating the one-dimensional vector,
Generating a one-dimensional vector by converting binary information corresponding to an opcode among binary information corresponding to each of the section codes;
How to include. delete The method of claim 1,
The classifying step,
Inputting the extracted feature points to a model trained by applying a machine learning technique; And
Classifying the malicious code data into a specific malicious code group by driving the model;
Containing, method. The method of claim 3,
The method, wherein the learned model is a gradient boosting model. The method of claim 3,
The classifying step,
Preventing overfitting by applying a bagging (Bootstrap Aggregating) algorithm to the extracted feature points;
The method further comprising. The method of claim 1,
The converting step,
Transforming the finite signal into the frequency domain by applying a discrete cosine transform;
Containing, method. The method of claim 6,
The converting step,
Transforming the finite signal into the frequency domain by applying a Discrete Fourier Transform;
Containing, method. The method of claim 1,
The converting step,
The finite signal is obtained by applying at least one of Cosine Transform, Fourier Transform, Short-Time Fourier Transform, Har transform, and Wavelet Transform. Converting into a frequency domain;
Containing, method. The method of claim 1,
The converting step,
Removing a DC component from the converted frequency domain and removing some of the data in a low frequency domain;
The method further comprising. The method of claim 1,
The malicious code data is an assembler (ASseMbler, ASM) file format or a bytes file format. A storage unit for storing at least one program;
A communication unit for receiving malicious code data; And
At least one processor for classifying malicious code data by executing the at least one program;
Including,
The storage unit, the at least one processor,
Separating the malicious code data for each section code;
Generating a one-dimensional vector by converting binary information corresponding to an opcode among binary information corresponding to each of the section codes;
Considering the generated one-dimensional vector as a finite signal and converting the finite signal into a frequency domain;
Extracting feature points based on the strength of signal components for each frequency in the frequency domain; And
Classifying the malicious code data into a specific malicious code group based on the extracted feature points;
Device, characterized in that it comprises instructions for executing. A computer-readable recording medium storing a program for executing the method of claim 1 on a computer.

Images