TW202205116A - Method for detecting malicious attacks and network security management device - Google Patents

Abstract

The invention provides a method for detecting malicious attacks by combining static and dynamic analysis and a network security management device. The method includes: extracting specific static analysis data of an unknown application, and determining whether the unknown application is a benign application or a malicious application based on the specific static analysis data; in response to determining that the unknown application is a malicious application, collecting specific dynamic analysis data of the unknown application, and determining a malware family to which the unknown application belongs based on the specific dynamic analysis data.

Description

Method and network security management device for detecting malicious attack

The present invention relates to a network security technology, and more particularly, to a method and network security management device for detecting malicious attacks by combining static and dynamic analysis.

With the advancement of technology, the performance improvement and functional diversification of smart devices have made people's lives more and more dependent on them. However, due to the storage of a lot of personal private information on smart devices, it has also become a target for hackers. With the ever-increasing number of malicious applications and morphing technologies, human-only application analysis is not feasible. In addition, static analysis techniques cannot analyze obfuscated applications and ignore malicious behavior during execution. In contrast, dynamic analysis has the disadvantage of consuming a lot of time and computing resources.

In view of this, the present invention provides a method and a network security management device for detecting malicious attacks by combining static and dynamic analysis, which can be used to solve the above-mentioned technical problems.

The present invention provides a method for detecting malicious attacks by combining static and dynamic analysis, suitable for a network security management device, comprising: extracting a specific static analysis data of an unknown application, and determining, based on the specific static analysis data, that the unknown application belongs to a benign application or a malicious application; and in response to determining that the unknown application is a malicious application, collecting a specific dynamic analysis data of the unknown application, and determining a malware family to which the unknown application belongs based on the specific dynamic analysis data.

The present invention provides a network security management device, which includes a storage circuit and a processor. The storage circuit stores a plurality of modules. The processor is coupled to the storage circuit, and accesses the aforementioned module to perform the following steps: extracting a specific static analysis data of an unknown application, and determining whether the unknown application belongs to a benign application or a malicious application based on the specific static analysis data; and in response to determining that the unknown application belongs to a malicious application, collecting a specific dynamic analysis data of the unknown application, and determining a malware family to which the unknown application belongs based on the specific dynamic analysis data.

In summary, the purpose of the present invention is to construct a mechanism capable of automatically detecting malicious applications and identifying the malware family to which the malicious application belongs. The network security management device proposed by the present invention can perform preliminary static detection before analyzing application programs, and filter out risky malicious programs. This method can greatly reduce the amount of dynamic data collection by the application in dynamic analysis, to help improve the speed of the entire dynamic analysis processing. And from the execution activities of the application, multiple types of packet features are simultaneously extracted to improve the accuracy of dynamic network packet analysis and detection, while reducing the false positive rate. Has the ability to classify malware families. Since different malware families have different malicious behaviors, the commonalities of samples in the same family are found through the classification results, and the behaviors and characteristics of malware families are further summarized. The system can detect malicious applications with similar malicious behavior and characteristics, regardless of the obfuscation technology changes malicious applications have undergone. After feeding back the new information of the newly added threat information database, the classifier generated in the next molding will be more and more accurate due to the increase of the information. It will be further explained below.

Please refer to FIG. 1A , which is a schematic diagram of a network security system architecture according to an embodiment of the present invention. As shown in FIG. 1A , the network security system architecture of the present invention may include a network security management device 100 , a network device 190 , an external application resource pool 195 and a plurality of electronic devices 199 . In one embodiment, when an enterprise wants to detect and block the threat of malicious applications by using the method for detecting malicious attacks provided by the present invention, the network security management device 100 can be set up at the network gateway within the enterprise, and through regular The external application resource pool 195 is accommodated and analyzed, and the network security management device 100 can periodically generate a black and white list of applications to the enterprise's network equipment 190 (eg firewall, proxy server). In addition, the network device 190 of the enterprise can also analyze the applications that are not on the black and white list (eg, the unknown application P1 ) through the network security management device 100 .

In different embodiments, the electronic device 199 may be an Internet of Things device, various smart devices, or other devices that need to download applications in the external application resource pool 195, but it is not limited thereto.

Please refer to FIG. 1B , which is a schematic diagram of a network security management device according to an embodiment of the present invention. As shown in FIG. 1B , the network security management device 100 may include a threat intelligence database 11 , a static analysis module 12 , a first model training module 13 , a dynamic analysis module 14 , a second model training module 15 and an intelligence module Data collection module 16.

In one embodiment, the intelligence gathering module 16 may be used to receive application intelligence from various sources. The application information sources are trusted internal and external data, and the content includes known benign applications (such as Google ^TM Store Top 1000), malicious applications (such as Drebin) and unknown applications P1, and can also integrate applications The static analysis data and dynamic analysis data generated by the program, as well as newly identified malicious applications, etc., are helpful for system classification, but are not limited to this.

The threat information database 11 can be used to store application information from different sources, such as known benign/malicious applications and unknown applications P1.

In FIG. 1B , the static analysis module 12 can be used to perform static analysis on the unknown application P1 to preliminarily determine whether the unknown application P1 is a benign application or a malicious application. If the unknown application P1 is a benign application, the information collection module 16 can correspondingly record the information of the unknown application P1, but it is not limited to this. On the other hand, if the static analysis module 12 determines that the unknown application P1 belongs to a malicious application, the dynamic analysis module 14 can accordingly be used to dynamically analyze the unknown application P1 to determine the malware to which the unknown application P1 belongs. family. The following will be supplemented with FIG. 2 for further description.

Please refer to FIG. 2 , which is a flowchart of a method for detecting malicious attacks by combining static and dynamic analysis according to an embodiment of the present invention. The method of this embodiment can be executed by the network security management apparatus 100 shown in FIGS. 1A and 1B . The details of each step in FIG. 2 will be described below in conjunction with the elements shown in FIGS. 1A and 1B .

In one embodiment, it is assumed that the electronic device 199 wants to download an unknown application P1 (eg, an updater) from the external application resource pool 195 . In this case, when the electronic device 199 sends a download request for the unknown application P1, the network device 190 and the network security management device 100 may first execute a certain mechanism to determine whether the electronic device 199 should be allowed to download the unknown application. P1.

For example, the network device 190 may store a black/white list of various applications, and if the unknown application P1 is determined to belong to the blacklist, the network device 190 may prohibit the electronic device 199 from downloading the unknown application P1. On the other hand, if the unknown application P1 is determined to belong to the whitelist, the network device 190 can accordingly allow the electronic device 199 to download the unknown application P1, but the invention is not limited thereto.

In other embodiments, if the unknown application P1 is determined not to belong to the above black/white list, the network security management device 100 can correspondingly execute the method of FIG. 2 to perform relevant static/dynamic analysis on the unknown application P1.

Specifically, in step S210, the static analysis module 12 may extract specific static analysis data SD1 of the unknown application P1, and determine whether the unknown application P1 is a benign application or a malicious application based on the specific static analysis data SD1.

In FIG. 1B , the static analysis module 12 may include a static analysis data feature extraction module 121 and a benign/malicious application detection model 122 . In one embodiment, the specific static analysis data SD1 is, for example, permission data of the unknown application P1, but not limited to this. In this case, the static analysis data feature extraction module 121 may use the aapt dump permission command to extract the declared permission list of the unknown application P1, for example. In one embodiment, the announcement permission list of the unknown application P1 may have the form shown in Table 1 below, but the present invention is not limited thereto. list of permissions android.permission.INTERACT_ACROSS_USERS_FULL android.permission.ACCESS_WIFI_STATE android.permission.CHANGE_WIFI_STATE android.permission.WRITE_EXTERNAL_STORAGE android.permission.READ_PHONE_STATE android.permission.WRITE_SETTINGS android.permission.CALL PHONE Table 1

Afterwards, the static analysis data feature extraction module 121 can convert the extracted permission list into a corresponding permission vector, for example, to serve as the specific static analysis data SD1, but it is not limited thereto. In other embodiments, the specific static analysis data SD1 may also be the OpCode of the unknown application P1 or other application static analysis data well known to those skilled in the art.

After that, the static analysis data feature extraction module 121 can feed the specific static analysis data SD1 into the benign/malicious application detection model 122, so that the benign/malicious application detection model 122 determines unknown applications according to the specific static analysis data SD1 P1 is a benign application or a malicious application.

In one embodiment, the benign/malicious application detection model 122 is, for example, a machine learning model (eg, a random forest model), which can be first detected based on static analysis data of a plurality of known applications. The model training module 13 is pre-trained.

For example, the first model training module 13 may include, for example, a benign/malicious application data set 131 , a static data feature extraction module 132 and a machine learning algorithm module 133 . In one embodiment, the first model training module 13 may obtain, for example, a plurality of known applications (including a plurality of known benign applications and a plurality of known malicious applications) from the threat intelligence database 11, and Save to benign/malicious application data set 131. After that, the first model training module 13 can extract the static data (such as permissions, OpCode, etc.) of each known application program through the static data feature extraction module 132 .

After that, the first model training module 13 can train benign/malicious application detection based on the static analysis data of each known benign application and the static analysis data of each known malicious application, for example, through the machine learning algorithm module 133 Model 122. Accordingly, the benign/malicious application detection model 122 can learn the benign static analysis data characteristics of the static analysis data of each known benign application in response to the static analysis data of each known benign application, and respond to each known malicious application. Application Static Analysis Data Learn the malicious static analysis data characteristics of the static analysis data of each known malicious application.

Therefore, when the benign/malicious application detection model 122 receives the specific static analysis data SD1, the benign/malicious application detection model 122 can accordingly determine that the unknown application P1 is a benign application or a malicious application. But the present invention may not be limited to this.

In one embodiment, if the unknown application P1 is determined to be a benign application, it means that the unknown application P1 should be safe for the electronic device 199, so the static analysis module 12 can accordingly allow the electronic device 199 to download the unknown application. Application P1, but not limited to this.

On the other hand, if the unknown application P1 is determined to be a malicious application, it means that the unknown application P1 has security concerns for the electronic device 199, so the static analysis module 12 can accordingly prohibit the electronic device 199 from downloading the unknown application. application program P1, and the network security management device 100 can continue to perform step S220 through the dynamic analysis module 14 to perform subsequent dynamic analysis on the unknown application program P1 determined as a malicious application program.

As shown in FIG. 2, in step S220, in response to determining that the unknown application P1 is a malicious application, the dynamic analysis module 14 may collect the specific dynamic analysis data DD1 of the unknown application P1, and determine the unknown application based on the specific dynamic analysis data DD1 Malware family to which application P1 belongs.

Specifically, as shown in FIG. 1B , the dynamic analysis module 14 includes a dynamic data feature extraction module 141 and a software family classification model 142 . In one embodiment, the dynamic data feature extraction module 141 can be used to extract the specific dynamic analysis data DD1 of the unknown application P1. In different embodiments, the specific dynamic analysis data DD1 is, for example, the network traffic content of the unknown application P1 and the related feature data of system calls, but it is not limited thereto.

In one embodiment, the above-mentioned network traffic content may include domain name system (DNS) packet content, Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, HTTP) packet content, transfer control protocol (transfer control protocol, TCP) content The packet content and other packet contents, and the above-mentioned various packet contents can be exemplified in Table 2 below, but not limited thereto. Internet traffic content TCP packets l Number of upstream/downstream packets l Upstream/downstream traffic l Average packet upstream/downstream traffic l Connection IP HTTP packets l HOST l Request-URI l Request-Method l User-Agent DNS packets l Domain Name other packets l Types of privacy leaks l IP reputation score Table 2

In addition, other packet contents may have other aspects as shown in Table 3 below, but are not limited thereto. content Types of privacy leaks l name l mac address l videos l date of birth l phone l passwords l gender l passport number l email lcontacts l photos l employment info l ssn l listofapps l IMEI l SIM serial number l address l location lIMSI l Credit card Privacy leaks l IMEI l Contact information IP Reputation Score l detected_url l detected_communicating l detected_download table 3

In some embodiments, the above various packet content acquisition methods can be, for example, to install the unknown application P1 in an android emulator, generate events through the monkey tool to trigger malicious behavior, and use tcpdump to obtain relevant network packets, from . In the pcap file, the characteristics of the content of DNS packets, TCP packets, HTTP packets and other network packets are respectively used. In addition, in one embodiment, the above-mentioned IP reputation score can be extracted through an application programming interface (API) of VirusTotal, but it is not limited thereto.

In one embodiment, after obtaining the required network traffic content, the dynamic data feature extraction module 141 can extract the feature as the specific dynamic analysis data DD1, but it is not limited to this. Afterwards, the dynamic data feature extraction module 141 may feed the specific dynamic analysis data DD1 into the software family classification model 142 , so that the software family classification model 142 determines the malware family to which the unknown application P1 belongs.

In one embodiment, the software family classification model 142 is, for example, a machine learning model (eg, a random forest model), which can be pre-trained by the second model training module 15 based on dynamic analysis data of a plurality of known applications pass.

For example, the second model training module 15 may include, for example, an application data set 151 of a known software family, a dynamic data feature extraction module 152 and a machine learning algorithm module 153 . In one embodiment, the second model training module 15 can obtain a plurality of known applications (including a plurality of known benign applications and a plurality of known malicious applications) and their The software family to which the individual belongs is stored in the application data set 151 of the known software family. Afterwards, the second model training module 15 can extract dynamic data (eg, network traffic content, system calls, etc.) of each known application program through the dynamic data feature extraction module 152 .

Afterwards, the second model training module 15 can, for example, through the machine learning algorithm module 153, train the software family based on the dynamic data of each known benign application, the dynamic data of each known malicious application and their respective software families Classification model 142 . After the training of the software family classification model 142 is completed, when the software family classification model 142 receives the specific dynamic analysis data DD1, the software family classification model 142 can accordingly determine the malware family to which the unknown application P1 belongs. The invention may not be limited to this.

In an embodiment of the present invention, the considered software family may include, for example, "BaseBridge", "DroidKungFu", "Plankton", "FakeDoc", "Iconosys", "Opfake", "FakeInstaller", "FakeRun", " There are 11 software families including Gappusin", "MobileTx" and "Benign", among which, except "Benign" which is a benign software family, the other 10 belong to malware families, but the present invention is not limited to this.

After determining the malware family to which the unknown application P1 belongs, the network security management device 100 can accordingly provide relevant information to the information security personnel for reference, so that the information security personnel can take corresponding network defense measures more efficiently .

In addition, it has been confirmed by experiments that the method of the present invention can achieve better software family classification accuracy and efficiency than the conventional methods that only perform static analysis or only dynamic analysis.

Specifically, in one embodiment, the benign/malicious application detection model 122 can be trained based on, for example, 1000 benign applications and 1024 malicious applications, and the software family classification model 142 can be trained based on, for example, 1410 malicious applications. Known apps for training. In this embodiment, the 1410 known applications may include, for example, 50 benign applications and 1360 malicious applications belonging to the above 10 malware families, but not limited thereto.

Afterwards, the network security management device 100 of the present invention can identify 100 malicious applications and 100 benign applications. That is, the network security management device 100 may regard the 100 malicious applications and the 100 benign applications as unknown applications individually (ie, there are 200 unknown applications in total), and perform the previously taught static Analysis and dynamic analysis.

In order to prove the identification performance of the present invention, the related detection results of the present invention and the detection results of the prior art (for example, the method only using dynamic analysis) are illustrated in Table 5 below. Number of false positives Time spent collecting dynamic data Accuracy Method of the present invention 11 1,900 minutes 94.5% Only the method of dynamic analysis 14 4,000 minutes 93% table 5

After testing, the method of the present invention determines 105 of the above 200 unknown applications as benign applications in the static analysis (ie, step S210 ) (that is, a total of 5 malicious applications are misjudged as benign applications), And in the dynamic analysis (ie, step S220 ), it takes about 1900 minutes to collect the specific dynamic analysis data of the remaining 95 unknown applications determined as malicious applications. Of the remaining 95 unknown applications, there were 6 software families of unknown applications that were misclassified. Therefore, in the method of the present invention, a total of 11 unknown application programs are misjudged.

In contrast, if only dynamic analysis is performed on the above 200 unknown applications, it takes about 4000 minutes to collect dynamic data of the 200 unknown applications, and a total of 14 unknown applications are misjudged. It can be seen that, the method of the present invention can not only effectively save the time for collecting dynamic data, but also can improve the accuracy of software family classification.

In addition, although there are methods for malicious threat detection using network traffic content in the prior art, most of them only focus on a single type of network traffic content (for example, only focus on HTTP packet content, TCP packet content, DNS packet content and other packets). content), thus ignoring the fact that other types of web traffic content also help to observe malware signatures.

However, since the present invention can simultaneously consider HTTP packet content, TCP packet content, DNS packet content and other packet contents when performing dynamic analysis, a more accurate detection result can be achieved by comparison.

In addition, since the process of obtaining the network traffic content is quite resource-intensive, it is not practical to directly extract the network traffic content of all unknown applications.

However, since the present invention finds out unknown applications belonging to malicious applications through static analysis before dynamic analysis is performed, it is only necessary to perform dynamic analysis on unknown applications determined as malicious applications, thus making it possible to simultaneously consider The idea of multiple web traffic content becomes feasible, which in turn improves the accuracy of identification.

Please refer to FIG. 3 , which is an accuracy comparison diagram according to an embodiment of the present invention. As shown in FIG. 3 , compared to the method of considering only a single type of network traffic content, the method of the present invention considering multiple network traffic contents at the same time has higher identification accuracy.

In summary, the present invention has at least the following features: (1) Constructing a malware detection and classification system by collecting public and private applications; (2) Combining static and dynamic analysis, effectively saving analysis resources for unknown applications and improve the accuracy; (3) It can improve the accuracy of dynamic network packet analysis and detection, while reducing the false positive rate; (4) By identifying the malware family to which the malicious application belongs, it helps the information security personnel to summarize the family characteristics, and then establish and implement preventive strategies.

In addition, the network security management device of the present invention can be deployed in an enterprise, and can automatically analyze and model public and private applications, so as to analyze and detect unknown applications. In addition, the threat information of malicious applications obtained by the method of the present invention can be provided as a third-party trusted blacklist to network devices such as firewalls and proxy servers for blacklist comparison to block downloads.

Although the present invention has been disclosed above by the embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, The protection scope of the present invention shall be determined by the scope of the appended patent application.

100: Network Security Management Device 11: Threat Intelligence Database 12: Static Analysis Module 121: Static analysis data feature extraction module 122: Benign/Malicious Application Detection Model 13: The first model training module 131: Benign/Malicious Application Dataset 132: Static data feature extraction module 133: Machine Learning Algorithm Module 14: Dynamic Analysis Module 141: Dynamic data feature extraction module 142: Software Family Classification Model 15: Second model training module 16: Information collection module 190: Network Equipment 195: External Application Resource Pool 199: Electronics P1: Unknown application S210, S220: Steps SD1: specific static analysis data DD1: Specific Dynamic Analysis Data

FIG. 1A is a schematic diagram of a network security system architecture according to an embodiment of the present invention. FIG. 1B is a schematic diagram of a network security management apparatus according to an embodiment of the present invention. FIG. 2 is a flowchart of a method for detecting malicious attacks by combining static and dynamic analysis according to an embodiment of the present invention. FIG. 3 is an accuracy comparison diagram according to an embodiment of the present invention.

S210, S220: Steps

Claims (12)

A method for detecting malicious attacks by combining static and dynamic analysis, suitable for a network security management device, comprising: extracting a specific static analysis data of an unknown application, and determining that the unknown application is a benign application or a malicious application based on the specific static analysis data; and In response to determining that the unknown application belongs to the malicious application, a specific dynamic analysis data of the unknown application is collected, and a malware family to which the unknown application belongs is determined based on the specific dynamic analysis data. The method of claim 1, wherein the step of judging whether the unknown application belongs to the benign application or the malicious application based on the specific static analysis data comprises: Feeding the specific static analysis data into a pretrained benign/malicious application detection model, wherein the benign/malicious application detection model determines that the unknown application belongs to the benign application in response to the specific static analysis data or the malicious application. The method according to claim 2, further comprising: Obtain a plurality of known applications from a threat intelligence database, and extract a static analysis data of each of the known applications, wherein the known applications include a plurality of known benign applications and a plurality of known malicious applications application; The benign/malicious application detection model is trained based on the static analysis data for each of the known benign applications and the static analysis data for each of the known malicious applications, wherein the benign/malicious application detection model corresponds to each The static analysis data of the known benign application learns the benign static analysis data characteristics of the static analysis data of the known benign applications, and learns the static analysis data of the known malicious applications in response to the static analysis data of the known malicious applications. The malicious static analysis data signature of the static analysis data of the known malicious application. The method of claim 1, wherein the step of determining the malware family to which the unknown application belongs based on the specific dynamic analysis data comprises: The specific dynamic analysis data is fed into a pretrained software family classification model, wherein the software family classification model determines the malware family to which the unknown application belongs in response to the specific dynamic analysis data. The method according to claim 4, further comprising: Obtain a plurality of known applications from a threat intelligence database, and extract a dynamic analysis data of each of the known applications, wherein the known applications include a plurality of known benign applications and a plurality of known malicious applications applications, and each of the known applications belongs to a corresponding software family; The software family classification model is trained based on the dynamic analysis data of each of the known benign applications, the software family to which they belong, and the dynamic analysis data of each of the known malicious applications, and the software family to which they belong. The method of claim 1, wherein the specific dynamic analysis data includes various network traffic content of the unknown application. The method of claim 6, wherein the network traffic contents include Domain Name System packet contents, Hypertext Transfer Protocol packet contents and Transmission Control Protocol packet contents. The method of claim 7, wherein the network traffic content further includes at least one of privacy leak type, privacy leak content and agreed address reputation score. The method of claim 1, wherein the step of extracting the specific static analysis data of the unknown application comprises: Extracting the specific static analysis data of the unknown application program in response to a download request made by an electronic device for the unknown application program, wherein the unknown application program has passed the verification of a black/white list. The method of claim 9, wherein in response to determining that the unknown application belongs to the benign application, the method further comprises: Allow the electronic device to download the unknown application. The method of claim 9, wherein in response to determining that the unknown application belongs to the malicious application, the method further comprises: The electronic device is prohibited from downloading the unknown application. A network security management device, comprising: a static analysis module that extracts a specific static analysis data of an unknown application, and determines that the unknown application belongs to a benign application or a malicious application based on the specific static analysis data; and a dynamic analysis module, which collects a specific dynamic analysis data of the unknown application in response to the static analysis module determining that the unknown application belongs to the malicious application, and determines the unknown application to which the unknown application belongs based on the specific dynamic analysis data of a malware family.

Images