A Novel Malware Clustering Method Using Frequency of Function Call Traces in Parallel Threads
スポンサーリンク
概要
- 論文の詳細を見る
With the rapid development and proliferation of the Internet, cyber attacks are increasingly and continually emerging and evolving nowadays. Malware - a generic term for computer viruses, worms, trojan horses, spywares, adwares, and bots - is a particularly lethal security threat. To cope with this security threat appropriately, we need to identify the malwares tendency/characteristic and analyze the malwares behaviors including their classification. In the previous works of classification technologies, the malwares have been classified by using data from dynamic analysis or code analysis. However, the works have not been succeeded to obtain efficient classification with high accuracy. In this paper, we propose a new classification method to cluster malware more effectively and more accurately. We firstly perform dynamic analysis to automatically obtain the execution traces of malwares. Then, we classify malwares into some clusters using their characteristics of the behavior that are derived from Windows API calls in parallel threads. We evaluated our classification method using 2,312 malware samples with different hash values. The samples classified into 1,221 groups by the result of three types of antivirus softwares were classified into 93 clusters. 90% of the samples used in the experiment were classified into 20 clusters at most. Moreover, it ensured that 39 malware samples had characteristics different from other samples, suggesting that these may be new types of malware. The kinds of Windows API calls confirmed the samples classified into the same cluster had the same characteristics. We made clear that antivirus softwares named different name to malwares that have same behavior.
- 2011-11-01
著者
-
SONG Jungsuk
National Institute of Information and Communications Technology
-
INOUE Daisuke
National Institute of Information and Communications Technology
-
ETO Masashi
National Institute of Information and Communications Technology
-
NAKAO Koji
National Institute of Information and Communications Technology
-
Inoue Daisuke
National Institute Of Information And Communicarions Technology
-
NAKAZATO Junji
National Institute of Information and Communications Technology
-
NAKAO Koji
the National Institute of Information and Communications Technology (NICT)
関連論文
- O-means: An Optimized Clustering Method for Analyzing Spam Based Attacks
- 招待講演 nicter: An Incident Analysis System for the Global Internet using Correlation between Network Monitoring and Malware Analysis
- 招待講演 nicter: An Incident Analysis System for the Global Internet using Correlation between Network Monitoring and Malware Analysis
- Fine-Grain Feature Extraction from Malware's Scan Behavior Based on Spectrum Analysis
- Malware Sandbox Analysis for Secure Observation of Vulnerability Exploitation
- Automated Malware Analysis System and Its Sandbox for Revealing Malware's Internal and External Activities
- Practical Correlation Analysis between Scan and Malware Profiles against Zero-Day Attacks Based on Darknet Monitoring
- Special Section on Information Theory and Its Applications
- Unsupervised Anomaly Detection Based on Clustering and Multiple One-Class SVM
- A Clustering Method for Improving Performance of Anomaly-Based Intrusion Detection System
- O-means : An Optimized Clustering Method for Analyzing Spam Based Attacks
- A Comparative Study of Unsupervised Anomaly Detection Techniques Using Honeypot Data
- P2P Network Traffic Analysis Using Data Mining Engines
- A Novel Malware Clustering Method Using Frequency of Function Call Traces in Parallel Threads
- An Empirical Evaluation of an Unpacking Method Implemented with Dynamic Binary Instrumentation
- Malware Sandbox Analysis with Efficient Observation of Herder's Behavior
- Malware Sandbox Analysis with Efficient Observation of Herder's Behavior
- Catching the Behavioral Differences between Multiple Executions for Malware Detection
- An Accurate Packer Identification Method Using Support Vector Machine
- Design and Implementation of Security for HIMALIS Architecture of Future Networks
- Towards Cost-Effective P2P Traffic Classification in Cloud Environment
- Catching the Behavioral Differences between Multiple Executions for Malware Detection