Native API 의 효과적인 전처리 방법을 이용한 악성 코드 탐지 방법에 관한 연구

국문 초록 (Abstract)

본 논문에서는 악성코드의 시스템 콜 빈도수를 특징값으로 행위 기반 탐지(behavior-based detection)를 할 때, 시스템 콜의 속성 개수보다 학습데이터 개수가 적더라도 효과적으로 악성 코드를 탐지하는 기법을 제안한다. 이 연구에서는, 프로그램 코드가 동작할 때, 발생시키는 윈도우 커널 데이터인 Native API를 수집하여 빈도수로 정규화한 것을 기본적인 속성 값으로 사용하였다. 또한 악성코드와 정상 코드를 효과적으로 분류할 수 있으면서, 악성코드를 분류하기 위한 기본적인 속성의 개수보다 학습데이터 개수가 적어도 적용 가능한 GLDA(Generalized Linear Discriminant Analysis)를 사용하여, 새로운 속성 값들로 전환하였다. 분류 기법으로는 베이지언 분류법의 일종인 kNN(k-Nearest Neighbor) 분류법을 이용하여 악성 코드를 탐지하였다. 제안된 탐지 기법의 성능을 검증하기 위하여 수집된 Native API 로 기존의 연구 방법과 비교 검증하였다. 본 논문에 제안된 기법이 탐지율(detection rate) 100%인 Threshold 값에서, 다른 탐지 기법보다 낮은 오탐율(false positive rate)을 나타내었다.

다국어 초록 (Multilingual Abstract)

In this paper, we propose an effective Behavior-based detection technique using the frequency of system calls to detect malicious code, when the number of training data is fewer than the number of properties on system calls. In this study, we collect the Native APIs which are Windows kernel data generated by running program code. Then we adopt the normalized freqeuncy of Native APIs as the basic properties. In addition, the basic properties are transformed to new properties by GLDA(Generalized Linear Discriminant Analysis) that is an effective method to discriminate between malicious code and normal code, although the number of training data is fewer than the number of properties. To detect the malicious code, kNN(k-Nearest Neighbor) classification, one of the bayesian classification technique, was used in this paper. We compared the proposed detection method with the other methods on collected Native APIs to verify efficiency of proposed method. It is presented that proposed detection method has a lower false positive rate than other methods on the threshold value when detection rate is 100%.

목차 (Table of Contents)

• 요약
• ABSTRACT
• I. 서론
• II. 관련연구
• III. 제안하는 탐지 기법
• IV. 실험 및 평가
• V. 결론
• 참고문헌

참고문헌 (Reference)

1 박남열, "우회기법을 이용하는 악성코드 행위기반 탐지 방법" 한국정보보호학회 16 (16): 17-28, 2006

2 G. Nebbett, "Windows nt/2000 native apireference" Macmillan Technical Publishing 2000

3 C. Kruegel, "Using decisiontrees to improve signature-based intrusiondetection, In Proceedings of the 6thInternational Workshop on the RecentAdvances in Intrusion Detection" 2820 : 173-191, 2003

4 Y. Liao, "Use of k-nearestneighbor classifier for intrusion detection" 21 (21): 439-448, 2002

5 S.J. Raudys, "Small samplesize effects in statistical pattern recognition:recommendations for practitioners" 13 (13): 252-264, 1991

6 R. P. W. Duin, "Small sample size generalization" 2 : 957-964, 1995

7 G. Hoglund, "Rootkits:subverting the windows kernel" PearsonEducation Inc. 2006

8 Q. Qian, "Research on hiddenmarkov model for system call anomalydetection, PAISI 2007" 4430 : 152-159, 2007

9 D.Q. Dai, "Regularizeddiscriminant analysis and its applicationto face recognition" 36 : 845-847, 2003

10 A. Papoulis, "Probability random variablesand stochastic processes" MCgraw-HILL 1991

11 N. Ye, "Probabilistic techniques for intrusiondetection based on computer auditdata" 32 (32): 266-274, 2001

12 I. Jolliffe, "Principal component analysis" Encyclopedia of Statistics in BehavioralScience 2002

13 E. Parzen, "On the estimation of aprobability density function and mode" 33 (33): 1065-1076, 1962

14 "Offensive Computing"

15 M. Wang, "Nativeapi based windows anomaly intrusiondetection method using svm" 1 : 2006

16 "Machine Learning Project at theUniversity of Waikato in New Zealand"

17 A.K. Ghosh, "Learning program behavior profilesfor intrusion detection" 1 : 1999

18 "Kaspersky lab"

19 S. Rawat, "Intrusion detection usingtext processing techniques with abinary-weighted cosine metric" 43-50, 2006

20 A. Sharma, "Intrusion detection using text processingtechniques with a kernel basedsimilarity measure" 26 (26): 488-495, 2007

21 S. Cho, "Efficient anomalydetection by modeling privilege flowsusing hidden Markov model" 22 (22): 45-55, 2003

22 G. J. McLachlan, "Discriminant analysisand statistical pattern recognition" JohnWiley & Sons, Inc 2005

23 S. Radosavac, "Detectionand classification of network intrusionsusing hidden markov models" 2003

24 C. Warrender, "Detecting intrusions usingsystem calls: alternative data models" 133-145, 1999

25 D. Buckely, "Areal time intrusion detection system forthe windows environment" IADIS 2007

26 J. Ye, "An optimization criterion for generalizeddiscriminant analysis on undersampledproblems" 26 (26): 2004

27 강태우, "API call의 단계별 복합분석을 통한 악성코드 탐지" 한국정보보호학회 17 (17): 89-98, 2007

28 S. Forrest, "A sense of self for unix processes" 120-128, 1996