KR20220038643A - Apparatus and method for malware lineage inference system with generating phylogeny - Google Patents

Abstract

The present disclosure relates to an apparatus and method for analyzing a malware evolution relation. According to one embodiment of the present invention, the method for analyzing the malware evolution relation comprises: a step of calculating first complexity of each of a plurality of pieces of malware binary; a step of selecting primally generated source binary by using the calculated first complexity; a step of inferring evolution order of a plurality of pieces of malware binary except for the source binary based on a degree of distance between the calculated first complexity and the plurality of pieces of malware binary.

Description

Apparatus and method for analyzing evolutionary relationship of malicious code {APPARATUS AND METHOD FOR MALWARE LINEAGE INFERENCE SYSTEM WITH GENERATING PHYLOGENY}

The present disclosure provides an apparatus and method for analyzing evolutionary relationships of malicious codes.

Malware created for malicious purposes causes serious damage to the system and system users. Although various methods are being researched to detect malicious code, malicious code writers also create new malicious code by continuously reinforcing functions to bypass the malicious code detection algorithm. The number of emerging malware is growing exponentially, making it increasingly difficult for analysts.

However, these newly emerged malicious codes are not new malicious codes that are completely different from existing malicious codes, and most of them are versions with modified or added functions based on existing malicious codes. Although it cannot be said that the existing malicious code and the new malicious code are the same or very similar, if the malicious code evolution relationship diagram is established, the new malicious code is analyzed from the previously analyzed malicious code by looking at the evolution of the malicious code from the viewpoint of the evolution of the organism. Compared to , analysis can be performed accurately and quickly.

Conventionally, an algorithm for automatically inferring the evolutionary relationship of malicious codes based on the size and complexity of a program has been developed based on the law of Software Evolution. However, inaccurate results may appear in the process of inferring the root and inferring the binaries built with “Released”. This is because, when built with “Released”, the size of the binary does not appear large just because the size of the actual code is large. In addition, a system for inferring evolutionary relationships after designing an artificial intelligence model using Creation Time information is presented. For malicious codes that do not provide creation time information properly, there is a limitation in that it is difficult to infer an accurate evolutionary relationship.

In the previous study, a method was proposed that classifies the families of malicious codes using existing tools and dynamically executes them to obtain the execution log, and then analyzes the evolutionary relationship for the malicious codes packed through the unpacking process. In addition, it was judged that the similarity was higher as there were more functions calling the same function by using the function of each program as a unit, rather than using the binary itself as an input. When using Unpacker, there are limitations in that the code of the existing binary can be changed and the evolutionary relationship cannot be normally inferred if the function is not properly identified.

The evolutionary relationship inference of software is being studied to figure out in what order the programs were developed from a set of programs whose version information is unknown. The evolutionary relationship of software can provide very useful information when classifying malicious code or tracking software vulnerabilities. In particular, it is very important to study how the existing malicious codes are transformed in order to analyze the new types of malicious codes that are being created in real time day by day. In addition, there is a limit to the analyst's ability to manually analyze numerous malicious codes newly discovered in the actual cyber environment.

Accordingly, there is a need for an immediate response to a new malicious code by automating the evolutionary relationship analysis of malicious code.

KR 10-1880796 KR 10-1512462

An object of the present invention is to provide an apparatus and method for analyzing the evolutionary relationship of malware. Another object of the present invention is to provide a recording medium in which a program for executing the method in a computer is recorded. The technical problem to be achieved by this embodiment is not limited to the technical problems as described above, and other technical problems may be inferred from the following embodiments.

As a technical means for achieving the above technical problem, a first aspect of the present disclosure provides a method for analyzing a malicious code evolution relationship, comprising: calculating a first complexity of each of a plurality of malicious code binaries; selecting a source binary first generated using a first complexity, and evolution of the plurality of malicious code binaries other than the source binary based on the calculated first complexity and distance between the plurality of malicious code binaries It is possible to provide a malicious code evolution relationship analysis method including the step of inferring the order.

In addition, the step of selecting the source binary includes selecting a malicious code binary having the lowest first complexity as the source binary from malicious code binaries classified into the same family among the plurality of malicious code binaries. It is possible to provide a method for analyzing the evolutionary relationship of malicious code.

In addition, calculating the first complexity includes calculating the complexity using dynamic analysis and static analysis, and the dynamic analysis determines the number of API sequences that each of the plurality of malicious code binaries call. extraction, and the static analysis extracts a second complexity of each of the plurality of malicious code binaries, wherein the extracted second complexity is determined by the sum of the number of nodes and the number of edges. A code evolution relationship analysis method can be provided.

In addition, the first complexity may provide a malicious code evolution relationship analysis method calculated according to Equation 1 below.

[Equation 1]

임의의 값으로 가중치에 해당하고, 상기 s는 상기 제 2복잡도, 상기 d는 상기 API 시퀀스 개수임)(here, the

An arbitrary value corresponds to a weight, where s is the second complexity, and d is the number of API sequences)

보다 작고, 상기 임의의 악성코드 바이너리가 안티디버깅 되어 있을 경우, 상기

보다 작고, 상기 임의의 악성코드 바이너리가 패킹 및 안티디버깅 되어 있지 않을 경우, 상기

가 동일한 것을 포함하는 악성코드 진화관계 분석 방법을 제공할 수 있다. In addition, if any malicious code binary among the plurality of malicious code binaries is packed, the

If it is smaller and the arbitrary malicious code binary is anti-debugging, the

If it is smaller and the arbitrary malicious code binary is not packed and anti-debugging, the

can provide a malicious code evolution relationship analysis method including the same.

In addition, the distance diagram may provide a method for analyzing the evolutionary relationship of malicious codes calculated according to Equation 2 below.

[Equation 2]

는 임의의 악성코드 바이너리 각각을 의미하며, 상기

는 상기

간의 거리도를 의미하며, 상기

는 상기

의 유사도임)(here, the above

denotes each of the arbitrary malicious code binaries,

is said

It means the distance between

is said

is the similarity of )

Also, it is possible to provide a malicious code evolution relationship analysis method in which the similarity is calculated using the number of API sequences.

In addition, the similarity is determined by using at least one of the Needleman-Wunsch Algorithm, the Smith-Waterman Algorithm, and the Hirschberg's Algorithm, a malicious code evolution relationship analysis method can provide

으로 식별하는 단계; 상기 복수의 악성코드 바이너리들 중 진화 순서가 식별된 악성코드 바이너리들의 집합은

이며, 상기 복수의 악성코드 바이너리들 중 진화 순서가 식별되지 않은 악성코드 바이너리들의 집합은

라 할 때, 상기

상기 제 1복잡도에 따라 오름차순으로 정렬하는 단계, 상기

에서 상기 제 1복잡도가 가장 낮은 바이너리를

로 선택하는 단계, 다음 수학식 3을 만족하는 상기

의 악성코드 바이너리를

로 선택하는 단계,In addition, the step of inferring the evolution order, the source binary

identifying as; A set of malicious code binaries whose evolution order is identified among the plurality of malicious code binaries is

A set of malicious code binaries whose evolution order is not identified among the plurality of malicious code binaries is

When said to

sorting in ascending order according to the first complexity;

The binary with the lowest first complexity in

Selecting as , wherein the following equation (3) is satisfied

of malware binaries

step to choose,

[Equation 3]

는 임의의 악성코드 바이너리 각각을 의미하며, 상기

는 상기

간의 거리도임)(here, the

denotes each of the arbitrary malicious code binaries,

is said

distance between them)

식별하는 단계, 상기

에서 자식이 없는 악성코드 바이너리들인

와 상기 식별된

에 대해

를 계산하는 단계, 상기

에 대해

를 계산하는 단계, 상기

가 상기

보다 적다면, 상기

를 상기

의 부모로 식별하는 단계 및 상기

에 상기 복수의 악성코드 바이너리들이 전부 포함될 때까지 반복하여 진화순서를 식별하는 단계를 포함하는 악성코드 진화관계 분석 방법을 제공할 수 있다.the selected

identifying, said

Malware binaries that have no children in

and identified above

About

calculating, said

About

calculating, said

is reminded

If less, the

to remind

identifying as the parent of the

It is possible to provide a malicious code evolution relationship analysis method comprising repeatedly identifying the evolution order until all of the plurality of malicious code binaries are included in the .

In addition, the step of inferring the evolutionary order may provide a malicious code evolution relationship analysis method further comprising the step of deriving a graph according to the identified evolutionary order.

A second aspect of the present disclosure may provide a recording medium in which a program for executing the method according to the first aspect in a computer is recorded.

A third aspect of the present disclosure provides an apparatus for analyzing a malicious code evolution relationship, comprising: a memory; and a processor, wherein the processor calculates a first complexity of each of a plurality of malicious code binaries, and The source binary generated first is selected using complexity 1, and the order of evolution of the plurality of malicious code binaries other than the source binary is inferred based on the calculated first complexity and the distance between the plurality of malicious code binaries. It is possible to provide a device for analyzing the evolutionary relationship of malicious code.

According to the present disclosure, when a large amount of malicious code is given, it is possible to calculate the first complexity of the malicious code binaries, select the source binary based on the first complexity of the malicious code binaries, and the distance between the malicious code binaries and the second 1Based on the complexity, the evolution order of malicious code binaries can be inferred. In addition, the evolution order of malicious code binaries can be inferred and derived as a graph. Accordingly, the evolution order of malicious code binaries can be effectively identified, the evolution order of malicious code binaries can be inferred and provided to the user effectively, and new malicious code can be analyzed accurately and quickly.

1 is a flowchart of a method of analyzing a malicious code evolution relationship according to an embodiment.
FIG. 2 is a detailed flowchart of steps 110 and 120 shown in FIG. 1 .
FIG. 3 is a detailed flowchart of step 130 shown in FIG. 1 .
4 and 5 are diagrams for explaining an example of inferring the evolution order of malicious code binaries and deriving a graph according to the inferred evolution order according to an embodiment.
6 is a block diagram of a malicious code evolution relationship analysis apparatus according to an embodiment.

The terms used in the present embodiments are selected as currently widely used general terms as possible while considering the functions in the present embodiments, which may vary depending on the intention or precedent of a person skilled in the art, the emergence of new technology, etc. there is. In addition, in certain cases, there are also terms arbitrarily selected by the applicant, and in this case, the meaning will be described in detail in the relevant part. Therefore, the terms used in the present embodiments should be defined based on the meaning of the term and the contents throughout the present embodiments, rather than the simple name of the term.

Since the present embodiments may have various changes and may have various forms, some embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the present embodiments to a specific disclosed form, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present embodiments. The terms used herein are used only for description of the embodiments, and are not intended to limit the present embodiments.

Unless otherwise defined, terms used in the present embodiments have the same meanings as commonly understood by those of ordinary skill in the art to which the present embodiments belong. Terms such as those defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related art, and unless explicitly defined in the present embodiments, have an ideal or excessively formal meaning. should not be interpreted.

Some embodiments of the present disclosure may be represented by functional block configurations and various processing steps. Some or all of these functional blocks may be implemented in various numbers of hardware and/or software configurations that perform specific functions. For example, the functional blocks of the present disclosure may be implemented by one or more microprocessors, or by circuit configurations for a given function. Also, for example, the functional blocks of the present disclosure may be implemented in various programming or scripting languages. The functional blocks may be implemented as an algorithm running on one or more processors. In addition, the present disclosure may employ prior art for electronic configuration, signal processing, and/or data processing, and the like. Terms such as “mechanism”, “element”, “means” and “configuration” may be used broadly and are not limited to mechanical and physical components. In addition, terms such as "unit" and "module" described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software, or a combination of hardware and software. there is.

In addition, the connecting lines or connecting members between the components shown in the drawings only exemplify functional connections and/or physical or circuit connections. In an actual device, a connection between components may be represented by various functional connections, physical connections, or circuit connections that are replaceable or added.

Hereinafter, the present disclosure will be described in detail with reference to the accompanying drawings.

1 is a flowchart of a method of analyzing a malicious code evolution relationship according to an embodiment. Referring to FIG. 1 , the apparatus for analyzing the evolutionary relationship of malicious code in step 110 may calculate a first complexity of each of a plurality of malicious code binaries.

Malicious code may include variant malicious code in addition to existing malicious code. Variant malicious code can be created by applying the following various techniques.

Malware variants can be generated by obfuscation techniques, and the obfuscation techniques include dead code insertion, register reassignment, subroutine reordering, and instruction replacement. substitution, code transportation, code integration, and the like.

The malicious code binary may be a machine language composed of 0 or 1 in order to allow the malicious code written for malicious purposes to be used internally in a computer, and is generally can be understood

The first complexity may mean the complexity of the malicious code binary, and may mean the performance or complexity of the malicious code.

A plurality of malicious code binaries may be given as input values in the system, and may include, but is not limited to, malicious code binaries classified into the same family.

Malicious code binaries classified into the same family are classified into the same group when malicious code binaries are input to programs produced by vaccine companies, computer program companies, etc. It may mean malicious code binaries classified into the same group.

The first complexity of the malicious code binary can be calculated using dynamic analysis and static analysis. Dynamic analysis refers to the method of executing and analyzing the target malicious code file, and static analysis is analysis without executing the malicious code file. It can mean how

The apparatus for analyzing the evolutionary relationship of malicious code may calculate the first complexity according to Equation 1 below based on the information extracted by performing dynamic analysis and static analysis.

[Equation 1]

No. 1

임의의 값으로 가중치에 해당하고 휴리스틱(huristic)하게 정할 수 있다. s는 정적 분석을 수행하여 추출된 정보에 해당하는 것으로, 제 2복잡도를 의미 할 수 있고, d는 동적 분석을 수행하여 추출된 정보에 해당하는 것으로, API 시퀀스 개수를 의미 할 수 있다.In Equation 1 above

An arbitrary value corresponds to a weight and can be determined heuristically. s corresponds to information extracted by performing static analysis, which may mean a second complexity, and d corresponds to information extracted by performing dynamic analysis, which may mean the number of API sequences.

The second complexity means the complexity of the call graph, which is a graph representing the call relationship between the unit programs constituting one program generated by the static analyzer, and the second complexity is the number of nodes and edges appearing in the call graph. It can represent the sum of numbers.

A function is called while a program in Windows is executed. The order of the system functions to be called is called an API sequence, and the number of API sequences may mean the number of APIs constituting the sequence.

In step 120, the apparatus for analyzing the evolution of malicious code may select the root binary (ROOT) using the first complexity calculated in step 110 .

The source binary is the first malicious code binary generated first within the evolutionary relationship of programs, and the malicious code binary with the lowest first complexity can be selected as the source binary. For example, the malicious code evolution relationship analysis apparatus may calculate a first complexity of each of the malicious code binaries classified into the same family, and select a malicious code binary having the lowest calculated first complexity as the source binary. Steps 110 and 120 will be described later in detail with reference to FIG. 2 .

In step 130, the apparatus for analyzing the evolutionary relationship of malicious code may infer the evolution order of malicious code binaries other than the source binary based on the calculated first complexity and distance between malicious code binaries. The malicious code evolution relationship analysis apparatus may use the distance diagram to infer the evolution order of malicious code binaries, and the distance diagram may be calculated according to Equation 2 below.

[Equation 2]

는 임의의 악성코드 바이너리 각각을 의미하며,

는

간의 거리도를 의미하며,

는

의 유사도를 나타낸다. 유사도는 자카드(Jaccard) 유사도를 의미 할 수 있으며, 거리도는 1에서 자카드 유사도를 뺀 값을 사용 할 수 있다.

stands for each arbitrary malicious code binary,

Is

It means the distance between

Is

shows the similarity of The similarity may mean a degree of similarity to Jaccard, and a value obtained by subtracting the degree of similarity to Jacquard from 1 may be used for the degree of distance.

는 50,

는 150이므로 유사도는

으로 계산될 수 있다. The malware evolution relationship analysis device may calculate the similarity by using the number of API sequences. For example, when the number of API sequences of the first malicious code binary and the second malicious code binary is 100, and the number of API sequences commonly called is 50,

is 50,

is 150, so the similarity is

can be calculated as

In addition, the malicious code evolution relationship analysis apparatus determines the similarity by using at least one of the Needleman-Wunsch Algorithm, the Smith-Waterman Algorithm, and the Hirschberg's Algorithm. can be calculated

The Needleman-Bnish algorithm calculates a global similarity score for the entire length of the sequences to be compared, and is an appropriate algorithm when the lengths of the two sequences to be compared are similar and every letter of the sequence is significant. The Smith-Waterman algorithm is designed to determine similar regions of parts of sequences to be compared. Instead of looking at the entire sequence, it can compare parts of all possible lengths and measure similarity. The Hirschberg algorithm is an algorithm that finds the optimal sequence alignment between two sequences.

In one embodiment, when calculating the number of API sequences commonly called by comparing the API sequences that malicious code binaries are dynamically executed and called, the Needleman-Wunsch Algorithm for Global Alignment that compares the entire sequence ), at least one of the Smith-Waterman Algorithm for Local Alignment comparing sequence parts, and Hirschberg's Algorithm for spatial complexity optimization can be used. However, the present invention is not necessarily limited thereto.

The malicious code evolution relationship analysis apparatus can infer the evolution order of malicious code binaries other than the source binary based on the first complexity and distance diagram, and step 130 will be described in detail later with reference to FIG. 3 .

FIG. 2 is a detailed flowchart of steps 110 and 120 shown in FIG. 1 . Since FIG. 2 corresponds to steps 110 and 120 of FIG. 1 , a redundant description will be omitted.

Referring to FIG. 2 , in step 210, the malicious code evolution relationship analysis apparatus performs dynamic analysis and static analysis on each of the malicious code binaries. Malicious code binaries may mean malicious code binaries classified into the same family, but is not limited thereto.

In one embodiment, the Cuckoo Sandbox may be used when performing dynamic analysis of malware binaries. The malicious code binary is executed in a sandbox environment, and the resulting value can be provided and used as information. The information provided by Cuckoo Sandbox appears in the form of a JSON (JavaScript Object Notation) file, and API sequence information is included in the JSON file.

Cuckoo Sandbox is an automated, dynamic malware analysis system that is used to scan suspicious files in an isolated environment, and JSON represents data objects in the form of properties and values to exchange low-volume data between the web and computer programs. is the format The result of the Cuckoo Sandbox can be generated in JSON format.

In addition, information of the call graph can be obtained by performing static analysis of the malicious code binary. A node in the call graph refers to a unit program, and an edge refers to a call between unit programs.

In step 220, the apparatus for analyzing the evolutionary relationship of the malicious code may extract the number of API sequences and the second complexity.

The number of API sequences can be extracted using API sequence information obtained by performing dynamic analysis of malicious code binaries, and the second complexity is extracted using call graph information obtained by performing static analysis of malicious code binaries. can do.

The number of API sequences may be the number of APIs constituting the sequence, and the second complexity may mean call graph complexity.

In operation 230, the first complexity of the malicious code binary may be calculated based on the extracted number of API sequences and the second complexity.

The malicious code evolution relationship analysis apparatus may calculate the first complexity according to Equation 1 described above in FIG. 1 .

임의의 값으로 가중치에 해당하고, 악성코드 바이너리의 특징을 파악하여 휴리스틱하게 정해질 수 있다.

It corresponds to a weight with an arbitrary value, and it can be determined heuristically by identifying the characteristics of the malicious code binary.

를 높일 수 있다. 그러나 악성코드 바이너리가 안티디버깅 되어 있다면 동적 분석 보다는 정적 분석이 정확하게 나타나므로

를 낮출 수 있다. 또한, 악성코드 바이너리가 패킹 및 안티디버깅이 되어 있지 않을 경우

가 동일할 수 있다.Malicious code binaries can be packed or anti-debugging. If the malicious code binary is packed, dynamic analysis is more accurate than static analysis.

can increase However, if the malware binary is anti-debugging, static analysis is more accurate than dynamic analysis.

can lower Also, if the malware binary is not packed and anti-debugging

may be the same.

Packing refers to a part of a program that is compressed and obfuscated so that it cannot be analyzed. Anti-debugging is a software technology that prevents reverse engineering or debugging, and is used when it is difficult to detect and remove malicious code. could mean to be

이고, 패킹되어 있으나 안티디버깅이 되어 있지 않은 악성코드 바이너리의 경우,

이고, 패킹되어 있지 않으나 안티디버깅이 되어 있는 상기 악성코드 바이너리의 경우,

을 사용할 수 있으나, 이에 제한되지 않는다. In one embodiment, when the malicious code evolution relationship analysis device calculates the first complexity of the malicious code binary, in the case of the malicious code binary that is not packed and anti-debugging,

, and in the case of a malicious code binary that is packed but not anti-debugging,

, and in the case of the malicious code binary that is not packed but is anti-debugging,

can be used, but is not limited thereto.

In operation 240, the apparatus for analyzing the evolution of malicious code may select a malicious code binary having the lowest first complexity of the malicious code binary as the root binary (ROOT).

FIG. 3 is a detailed flowchart of step 130 shown in FIG. 1 . Since FIG. 3 corresponds to step 130 of FIG. 1 , a redundant description will be omitted.

Referring to FIG. 3 , in step 310 , the apparatus for analyzing the evolutionary relationship of malicious code may identify the source binary as P ₁ . The apparatus for analyzing the evolutionary relationship of malicious code may identify a source binary as P ₁ among malicious code binaries classified into the same family.

The source binary is the first malicious code binary generated first, and the malware evolution relationship analysis device can select the source binary and infer the evolution order of malicious code binaries other than the source binary based on the source binary.

의 악성코드 바이너리들을 제 1복잡도에 따라 오름차순으로 정렬할 수 있다. 악성코드 진화관계 분석 장치는

의 악성코드 바이너리들을 제 1복잡도가 낮은 순으로 정렬할 수 있다.In step 320. Malicious code evolution relationship analysis device

of malicious code binaries can be sorted in ascending order according to the first complexity. Malicious code evolution relationship analysis device

of malicious code binaries can be sorted in the order of the lowest first complexity.

은 복수의 악성코드 바이너리들 중 진화 순서가 식별된 악성코드 바이너리들의 집합을 의미하고,

은 복수의 악성코드 바이너리들 중 진화 순서가 식별되지 않은 악성코드 바이너리들의 집합을 의미할 수 있다.

denotes a set of malicious code binaries whose evolution order is identified among a plurality of malicious code binaries,

may mean a set of malicious code binaries whose evolution order is not identified among the plurality of malicious code binaries.

및

는 같은 패밀리로 분류된 악성코드 바이너리들에 포함된 집합일 수 있다. 단계 330에서 악성코드 진화관계 분석 장치는

에서 제 1복잡도가 가장 낮은 원소를 P_j로 선택할 수 있다. In one embodiment,

and

may be a set included in malicious code binaries classified into the same family. In step 330, the malware evolution relationship analysis device

In , the element having the lowest first complexity may be selected as P _j .

원소 중 P_j와 가장 거리도가 적은 원소를 P_i로 선택할 수 있다. In step 340, the malicious code evolution relationship analysis device

Among the elements, the element with the smallest distance from P _j may be selected as P _i .

에 포함된 모든 악성코드 바이너리들과

에 포함된 P_j 의 거리도를 계산하여 비교하고,

에 포함된 모든 악성코드 바이너리들 중 P_j 와의 거리도가 가장 적은 원소를 P_i로 선택할 수 있다.Specifically, the malware evolution relationship analysis device is

All malware binaries included in

Calculate and compare the distance diagram of P _j included in

Among all the malicious code binaries included in , the element with the smallest distance from P _j can be selected as P _i .

In step 350, the apparatus for analyzing the evolutionary relationship of malicious code may identify P _j as a child of P _i .

Parent and child are expressions to indicate the order or hierarchical structure in the evolutionary relationship, and the evolutionary relationship between malicious code binaries is related. can be called children.

The malware evolution relationship analysis device can identify P _j as a child of P _{i ,} and can be identified as the parent of P _j , The evolutionary order of P _i may be faster than P _j .

<

인 경우, P_k를 P_j의 부모로 식별할 수 있다. In step 360, the malware evolution relationship analysis device

<

, P _k may be identified as a parent of P _j .

와

를 계산하여

<

인 경우, P_k를 P_j의 부모로 식별할 수 있고, P_j는 P_k의 자식으로 식별될 수 있다. 한편,

>

인 경우, P_k를 P_j의 부모로 식별하지 않을 수 있다.Specifically, the malware evolution relationship analysis device is

Wow

by calculating

<

, P _k may be identified as a parent of P _j , and P _j may be identified as a child of P _k . Meanwhile,

>

, P _k may not be identified as a parent of P _j .

In an embodiment, the malicious code binaries are divided into different branches during evolution and merge into one according to a certain rule may occur. The malware evolution relationship analysis device branches and merges the malicious code binaries. It can be analyzed in the form in which it can occur. Therefore, there may not be a one-to-one correspondence between parent and child, and multiple parent malicious code binaries may exist for arbitrary child malicious code binaries.

에 포함될 때까지 과정을 반복할 수 있다. Referring to FIG. 3 , in step 370, the apparatus for analyzing the evolutionary relationship of malicious code records all malicious code binaries.

The process can be repeated until included in

의 악성코드 바이너리들이 모두 진화 순서가 식별되어

에 포함될 때까지, 단계 320부터 단계 370을 반복할 수 있다. 모든 악성코드 바이너리들이

에 포함되는 과정을 통해, 악성코드 바이너리들의 진화 순서를 추론할 수 있다.In one embodiment, since the source binary is one among the malicious code binaries classified into the same family, step 310 may be excluded, and the evolution order is not identified.

of the malware binaries are identified in the evolution order

Steps 320 to 370 may be repeated until included in . All malware binaries

Through the process included in

In addition, the malicious code evolution relationship analysis apparatus may derive a graph according to the evolution order of the malicious code binaries.

The graph may include, but is not limited to, a figure, table, chart, diagram, etc. that can visually represent the evolution order of malicious code binaries.

The malicious code evolution relationship analysis device may deduce the evolution order of malicious code binaries and then derive a graph according to the evolution order, or may derive a graph while inferring the evolution order of the malicious code binaries.

4 and 5 are diagrams for explaining an example of inferring the evolution order of malicious code binaries and deriving a graph according to the inferred evolution order according to an embodiment.

(410)은 복수의 악성코드 바이너리들 중 진화 순서가 식별된 악성코드 바이너리들의 집합을 의미하고,

(420)는 복수의 악성코드 바이너리들 중 진화 순서가 식별되지 않은 악성코드 바이너리들의 집합을 의미할 수 있다. Referring to FIG. 4 , P ₁ , P ₂ , P ₃ , etc. may mean arbitrary malicious code binaries, and P _M may mean that the number of malicious code binaries classified into the same family is M.

410 denotes a set of malicious code binaries whose evolution order is identified among a plurality of malicious code binaries,

Reference 420 may refer to a set of malicious code binaries whose evolution order is not identified among the plurality of malicious code binaries.

(410)에 포함되어 있고, P₁, P₂, P₃, P₄ ???? P_M 순으로 제 1복잡도가 높아지는 것을 가정한다.P ₁ is identified as the root binary,

(410), P ₁ , P ₂ , P ₃ , P ₄ ???? It is assumed that the first complexity increases in the order of P _M.

(420)에서 제 1복잡도가 가장 낮은 악성코드 바이너리 P₂를 선택하고,

(410)에는 P₁만 존재하므로 P₂는 P₁의 자식으로 식별할 수 있다.In one embodiment, after identifying P ₁ and sorting the first complexity in ascending order (P ₂ , P ₃ , P ₄ , ????P _M ),

In (420), the malware binary P ₂ having the lowest first complexity is selected,

Since only P ₁ exists in 410 , P ₂ can be identified as a child of P ₁ .

(420)에서 제 1복잡도가 가장 낮은 악성코드 바이너리 P₃를 선택하여,

(410)에는 P₁ 및 P₂가 존재하므로

및

를 계산하고,

가

보다 작은 값임을 가정하여 P₃는 P₁의 자식으로 식별할 수 있다.If the evolutionary order of P ₂ and P ₁ is identified,

In (420), the malware binary P ₃ having the lowest first complexity is selected,

Since P ₁ and P ₂ exist in (410),

and

to calculate,

go

Assuming that it is a smaller value, P ₃ can be identified as a child of P ₁ .

(420)에서 제 1복잡도가 가장 낮은 악성코드 바이너리 P₄를 선택한다.

(410)에는 P₁, P₂ 및 P₃가 존재하므로

,

및

를 계산하고,

,

,

중

가 가장 작은 값임을 가정하여 P₄는 P₂의 자식으로 식별할 수 있다. If the evolutionary order of P ₁ , P ₂ , P ₃ was identified,

In step 420, a malware binary P ₄ having the lowest first complexity is selected.

Since P ₁ , P ₂ and P ₃ exist in (410),

,

and

to calculate,

,

,

middle

Assuming that is the smallest value, P ₄ can be identified as a child of P ₂ .

The malicious code evolution relationship analysis apparatus may derive the evolution order of malicious code binaries as a graph. The graph may be represented as a directed acyclic graph, but is not limited thereto.

In an embodiment, P ₁ , P ₂ , P ₃ , etc. may mean arbitrary malicious code binaries, and the malicious code binaries may be expressed as a circle. The relationship between parent and child can be represented by connecting arrows.

(420)에서 제 1복잡도가 가장 낮은 악성코드 바이너리 P₂를 선택하여 원을 그려 표현할 수 있다.

(410)에는 P₁만 존재하므로 P₂는 P₁의 자식으로 화살표로 연결할 수 있다. 그리고, P₃를 원을 그려 표현하고,

및

를 계산하고,

가

보다 작은 값임을 가정하여 P₃는 P₁의 자식으로 화살표로 연결할 수 있다. 다음으로, P₄를 원을 그려 표현하고,

,

및

를 계산하고,

,

,

중

가 가장 작은 값임을 가정하여 P₄는 P₂의 자식으로 화살표로 연결하여 그래프로 도출할 수 있다. For example, the root binary P ₁ is expressed by drawing a circle, and the first complexity is sorted in ascending order (P ₂ , P ₃ , P ₄ , ????P _M ),

In 420, a circle may be drawn by selecting the malware binary P ₂ having the lowest first complexity.

Since only P ₁ exists in 410 , P ₂ can be connected with an arrow as a child of P ₁ . And, P ₃ is expressed by drawing a circle,

and

to calculate,

go

Assuming a smaller value, P ₃ can be connected with an arrow as a child of P ₁ . Next, P ₄ is expressed by drawing a circle,

,

and

to calculate,

,

,

middle

Assuming that is the smallest value, P ₄ is a child of P ₂ and can be derived as a graph by connecting it with an arrow.

(420)의 P₄와

(410)의 P₄는 동일한 악성코드 바이너리이며, P₄가 연결된 점선은

(420) 에서 P₄를 선택하고, P₄의 진화순서가 식별되어

(410)에 포함되는 과정을 설명하기 위한 것으로 그래프로 도출 시에는 생략할 수 있다..

(420) with P ₄

P ₄ in (410) is the same malicious code binary, and the dotted line connected to P ₄ is

Select P ₄ from 420, and the evolution order of P ₄ is identified.

It is for explaining the process included in 410 and may be omitted when deriving as a graph.

은 진화 순서가 식별된 악성코드 바이너리들의 집합을 의미하고,

는 진화 순서가 식별되지 않은 악성코드 바이너리들의 집합을 의미할 수 있다. Referring to FIG. 5 , P ₁ , P ₂ , P ₃ , etc. may mean arbitrary malicious code binaries, and P _M may mean that the number of malicious code binaries classified into the same family is M.

denotes a set of malicious code binaries whose evolutionary order has been identified,

may mean a set of malicious code binaries whose evolutionary order is not identified.

에 포함되어 있고, P₁, P₂, P₃, P₄ ???? P_M 순으로 제 1복잡도가 높아지는 것을 가정한다. 한편, 도 5는 도 4에 이어지는 내용으로 중복되는 설명은 생략한다.P ₁ is identified as the root binary,

is contained in P ₁ , P ₂ , P ₃ , P ₄ ???? It is assumed that the first complexity increases in the order of P _M. Meanwhile, in FIG. 5 , overlapping descriptions of the contents following FIG. 4 will be omitted.

In an embodiment, if the relationship between P ₄ and P ₃ is inferior to the relationship between P ₂ and P ₃ , the apparatus for analyzing the evolutionary relationship of malicious code indicates that the distance between P ₄ and P ₃ is greater than the distance between P ₂ and P ₃ have to go away However, if the distance between P ₄ and P ₃ is closer than the distance between P ₂ and P ₃ , then P ₄ is highly correlated with P ₃ , and P ₃ can be identified as the parent of P ₄ .

에서 자식이 없는 악성코드 바이너리에 해당하고, 도 3의 P_k에 해당할 수 있다. P₄는 P₂의 자식으로 식별된 악성코드 바이너리에 해당하고, 도 3의 P_j에 해당할 수 있다. P₂는 P₄의 부모로 식별된 악성코드 바이너리에 해당하고, 도 3의 P_j의 부모에 해당할 수 있다.

및

를 계산하고,

가

보다 작은 값임을 가정하여, P₃을 P₄의 부모로 식별할 수 있다. For example, it is assumed that P ₁ , P ₂ , P ₃ , and P ₄ are identified as in FIG. 4 . P ₃ is

Corresponds to a malicious code binary having no children in , and may correspond to P _k of FIG. 3 . P ₄ corresponds to a malicious code binary identified as a child of P ₂ , and may correspond to P _j in FIG. 3 . P ₂ may correspond to the malicious code binary identified as the parent of P ₄ , and may correspond to the parent of P _j in FIG. 3 .

and

to calculate,

go

Assuming a smaller value, P ₃ can be identified as a parent of P ₄ .

The malicious code evolution relationship analysis apparatus may derive the evolution order of malicious code binaries as a graph.

및

를 계산하고,

가

보다 작은 값임을 가정하여, P₃을 P₄의 부모로 화살표로 연결하여 그래프로 도출할 수 있다. For example, it is assumed that P ₁ , P ₂ , P ₃ , and P ₄ are expressed in the same graph as in FIG. 4 .

and

to calculate,

go

Assuming that it is a smaller value, it can be derived as a graph by connecting P ₃ as the parent of P ₄ with an arrow.

6 is a block diagram of a malicious code evolution relationship analysis apparatus according to an embodiment.

Referring to FIG. 6 , the malicious code evolution relationship analysis apparatus 600 may include a memory 610 and a processor 620 . In the malicious code evolution relationship analysis apparatus 600 shown in FIG. 6, only the components related to the embodiment are shown. Accordingly, it can be understood by those skilled in the art that other general-purpose components may be further included in addition to the components shown in FIG. 6 .

The memory 610 is hardware for storing various data processed in the malicious code evolution relationship analysis device 600 . For example, the memory 610 may store a value obtained by calculating the first complexity of the malicious code binary. Also, the memory 610 may store malicious code binaries classified into the same family, a value obtained by calculating a distance between the malicious code binaries, and the like. The memory 530 is a random access memory (RAM), such as dynamic random access memory (DRAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), CD- It may include ROM, Blu-ray or other optical disk storage, a hard disk drive (HDD), a solid state drive (SSD), or flash memory.

The processor 620 performs an overall function for analyzing the malicious code evolution relationship described above with reference to FIGS. 1 to 5 .

In an embodiment, the processor 620 may calculate a first complexity of each of the plurality of malicious code binaries. Also, the processor 620 may select the first generated source binary by using the calculated first complexity. The processor 620 may infer the evolution order of malicious code binaries other than the source binary based on the calculated first complexity and distance between the plurality of malicious code binaries.

The present embodiments may also be implemented in the form of a recording medium in which a program such as a program module executed by a computer is recorded. Computer-readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, computer-readable media may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes computer readable instructions, data structures, other data in modulated data signals, such as program modules, or other transport mechanisms, and includes any information delivery media.

Also, in this specification, "unit" may be a hardware component such as a processor or circuit, and/or a software component executed by a hardware component such as a processor.

The description of the present specification described above is for illustration, and those of ordinary skill in the art to which the content of this specification belongs will understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be able Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. For example, each component described as a single type may be implemented in a dispersed form, and likewise components described as distributed may be implemented in a combined form.

The description of the above-described embodiments is merely exemplary, and it will be understood by those skilled in the art that various modifications and equivalent other embodiments are possible therefrom. Accordingly, the true scope of protection of the invention should be defined by the appended claims, and all differences within the scope of equivalents to those described in the claims should be construed as being included in the protection scope defined by the claims.

Claims (10)

In the method of analyzing the evolutionary relationship of malicious code through the processor of the device for analyzing the evolution of malicious code,
calculating a first complexity of each of a plurality of malicious code binaries through the processor;
selecting, through the processor, a source binary first generated using the calculated first complexity; and
inferring the evolution order of the plurality of malicious code binaries in addition to the source binary based on the calculated first complexity through the processor and the distance between the plurality of malicious code binaries;
The first complexity is calculated according to Equation 1 below,
[Equation 1]

(here, the

Corresponds to a weight with an arbitrary value, where s is the second complexity, and d is the number of API sequences)
If any malicious code binary among the plurality of malicious code binaries is packed, the

smaller than,
If the arbitrary malicious code binary is anti-debugging, the

smaller than,
If the arbitrary malicious code binary is not packed and anti-debugging, the

Malicious code evolution relationship analysis method, including the same. The method of claim 1,
The step of selecting the source binary,
and selecting a malicious code binary having the lowest first complexity as the source binary from among the plurality of malicious code binaries classified into the same family. The method of claim 1,
Calculating the first complexity comprises:
Calculating the first complexity using dynamic analysis and static analysis;
The dynamic analysis extracts the number of API sequences called by each of the plurality of malicious code binaries,
The static analysis extracts the second complexity of each of the plurality of malicious code binaries, wherein the extracted second complexity is determined by the sum of the number of nodes and the number of edges. Evolutionary relationship analysis method. The method of claim 1,
The distance diagram is
A malicious code evolution relationship analysis method calculated according to Equation 2 below.
[Equation 2]

(here,

denotes each of the arbitrary malicious code binaries,

is said

It means the distance between

is said

is the similarity of ) 5. The method of claim 4,
wherein the similarity is calculated using the number of API sequences. 6. The method of claim 5,
The similarity is determined by using at least one of Needleman-Wunsch Algorithm, Smith-Waterman Algorithm, and Hirschberg's Algorithm. The method of claim 1,
Inferring the evolution order comprises:
the source binary

identifying as;
A set of malicious code binaries whose evolution order is identified among the plurality of malicious code binaries is

A set of malicious code binaries whose evolution order is not identified among the plurality of malicious code binaries is

When said to

sorting in ascending order according to the first complexity;
remind

The malware binary with the lowest first complexity in

selecting as;
The above that satisfies the following Equation (3)

of malware binaries

selecting as;
[Equation 3]

(here, the

denotes each of the arbitrary malicious code binaries,

is said

distance between them)
the selected

identifying;
remind

Malware binaries that have no children in

and identified above

About

calculating ;
remind

About

calculating ;
remind

is reminded

If less, the

to remind

to identify as the parent of; and
remind

and repeatedly identifying the evolution order until all of the plurality of malicious code binaries are included in the malicious code evolution relationship analysis method. 8. The method of claim 7,
Inferring the evolution order comprises:
Deriving a graph according to the identified evolutionary order; Malware evolution relationship analysis method further comprising a. A recording medium recording a program for executing the method according to any one of claims 1 to 8 in a computer. In the device for analyzing the evolutionary relationship of malicious code,
memory: and
including a processor;
The processor is
calculating a first complexity of each of the plurality of malware binaries;
selecting a source binary first generated using the calculated first complexity;
infer the evolution order of the plurality of malicious code binaries other than the source binary based on the calculated first complexity and the distance between the plurality of malicious code binaries;
The first complexity is calculated according to Equation 1 below,
[Equation 1]

(here, the

Corresponds to a weight with an arbitrary value, where s is the second complexity, and d is the number of API sequences)
If any malicious code binary among the plurality of malicious code binaries is packed, the

smaller than,
If the arbitrary malicious code binary is anti-debugging, the

smaller than,
If the arbitrary malicious code binary is not packed and anti-debugging, the

Malicious code evolution relationship analysis device including the same.

Images