• Title/Summary/Keyword: 변종

Search Result 1,346, Processing Time 0.026 seconds

A Study on Classification of Variant Malware Family Based on ResNet-Variational AutoEncoder (ResNet-Variational AutoEncoder기반 변종 악성코드 패밀리 분류 연구)

  • Lee, Young-jeon;Han, Myung-Mook
    • Journal of Internet Computing and Services
    • /
    • v.22 no.2
    • /
    • pp.1-9
    • /
    • 2021
  • Traditionally, most malicious codes have been analyzed using feature information extracted by domain experts. However, this feature-based analysis method depends on the analyst's capabilities and has limitations in detecting variant malicious codes that have modified existing malicious codes. In this study, we propose a ResNet-Variational AutoEncder-based variant malware classification method that can classify a family of variant malware without domain expert intervention. The Variational AutoEncoder network has the characteristics of creating new data within a normal distribution and understanding the characteristics of the data well in the learning process of training data provided as input values. In this study, important features of malicious code could be extracted by extracting latent variables in the learning process of Variational AutoEncoder. In addition, transfer learning was performed to better learn the characteristics of the training data and increase the efficiency of learning. The learning parameters of the ResNet-152 model pre-trained with the ImageNet Dataset were transferred to the learning parameters of the Encoder Network. The ResNet-Variational AutoEncoder that performed transfer learning showed higher performance than the existing Variational AutoEncoder and provided learning efficiency. Meanwhile, an ensemble model, Stacking Classifier, was used as a method for classifying variant malicious codes. As a result of learning the Stacking Classifier based on the characteristic data of the variant malware extracted by the Encoder Network of the ResNet-VAE model, an accuracy of 98.66% and an F1-Score of 98.68 were obtained.

Malware Family Recommendation using Multiple Sequence Alignment (다중 서열 정렬 기법을 이용한 악성코드 패밀리 추천)

  • Cho, In Kyeom;Im, Eul Gyu
    • Journal of KIISE
    • /
    • v.43 no.3
    • /
    • pp.289-295
    • /
    • 2016
  • Malware authors spread malware variants in order to evade detection. It's hard to detect malware variants using static analysis. Therefore dynamic analysis based on API call information is necessary. In this paper, we proposed a malware family recommendation method to assist malware analysts in classifying malware variants. Our proposed method extract API call information of malware families by dynamic analysis. Then the multiple sequence alignment technique was applied to the extracted API call information. A signature of each family was extracted from the alignment results. By the similarity of the extracted signatures, our proposed method recommends three family candidates for unknown malware. We also measured the accuracy of our proposed method in an experiment using real malware samples.

A Study on Malicious Codes Grouping and Analysis Using Visualization (시각화 기법을 이용한 악성코드 분석 및 분류 연구)

  • Song, In-Soo;Lee, Dong-Hui;Kim, Kui-Nam
    • Convergence Security Journal
    • /
    • v.10 no.3
    • /
    • pp.51-60
    • /
    • 2010
  • The expansion of internet technology has made convenience. On the one hand various malicious code is produced. The number of malicious codes occurrence has dramadically increasing, and new or variant malicious code circulation very serious, So it is time to require analysis about malicious code. About malicious code require set criteria for judgment, malicious code taxonomy using Algorithm of weakness difficult to new or variant malicious code taxonomy but already discovered malicious code taxonomy is effective. Therefore this paper of object is various malicious code analysis besides new or variant malicious code type or form deduction using visualization of strong. Thus this paper proposes a malicious code analysis and grouping method using visualization.

Flora of Hallyo-Haesang National Park - Case Study of Namhae, Karasan and Tongyong Areas - (한려해상국립공원 지역의 관속식물상 - 남해, 가라산, 통영 지역을 대상으로 -)

  • 김용식;임동옥;전승훈;신현탁
    • Korean Journal of Environment and Ecology
    • /
    • v.12 no.4
    • /
    • pp.301-316
    • /
    • 1999
  • The flora of the Hallyo-Haesang National Park were surveyed from May to September, 1998. The flora of this park were listed as 117 families, 296 genus, 373 species, 53 varieties, 7 forms and 3 hybrid in the Namhae, 73 families, 129 genus, 153 species, 16 varieties and 2 forms in Karasan(Mountain), 97 families, 280 genus, 475 species, 53 varieties, 5 forms and 1 hybrid in the Tongyong. Construction of road, recreational facilities and ornamental farms were considered as the major causes of destruction of vegetation conservational measures must be applied urgently to conserve the distinct vegetation and flora of this areas.

  • PDF

Taxonomical Evaluation of Two Varieties of Perinereis nuntia : P. nuntia var. vallata (Grube 1857) and P. nuntia var. brevicirris (Grube 1857) (Perinereis nuntia의 2변종의 분류에 관한 연구)

  • PAIK Eui-In
    • Korean Journal of Fisheries and Aquatic Sciences
    • /
    • v.8 no.4
    • /
    • pp.242-244
    • /
    • 1975
  • Taxonomical evaluation of P. nuntia var. vallata and P. nuntia var. brevicirris Grube was checked. On the basis of the number of paragnaths and its arrangement pattern it is suggested that these two varieties are no longer valid, and they are synonym of Perinereis nuntia(Savigny, 1818).

  • PDF

Detection Model based on Deeplearning through the Characteristics Image of Malware (악성코드의 특성 이미지화를 통한 딥러닝 기반의 탐지 모델)

  • Hwang, Yoon-Cheol;Mun, Hyung-Jin
    • Journal of Convergence for Information Technology
    • /
    • v.11 no.11
    • /
    • pp.137-142
    • /
    • 2021
  • Although the internet has gained many conveniences and benefits, it is causing economic and social damage to users due to intelligent malware. Most of the signature-based anti-virus programs are used to detect and defend this, but it is insufficient to prevent malware variants becoming more intelligent. Therefore, we proposes a model that detects and defends the intelligent malware that is pouring out in the paper. The proposed model learns by imaging the characteristics of malware based on deeplearning, and detects newly detected malware variants using the learned model. It was shown that the proposed model detects not only the existing malware but also most of the variants that transform the existing malware.

PE file malware detection using opcode and IAT (Opcode와 IAT를 활용한 PE 파일 악성코드 탐지)

  • JeongHun Lee;Ah Reum Kang
    • Proceedings of the Korean Society of Computer Information Conference
    • /
    • 2023.01a
    • /
    • pp.103-106
    • /
    • 2023
  • 코로나 팬데믹 사태로 인해 업무환경이 재택근무를 하는 환경으로 바뀌고 악성코드의 변종 또한 빠르게 발전하고 있다. 악성코드를 분석하고 백신 프로그램을 만들면 새로운 변종 악성코드가 생기고 변종에 대한 백신프로그램이 만들어 질 때까지 변종된 악성코드는 사용자에게 위협이 된다. 본 연구에서는 머신러닝 알고리즘을 사용하여 악성파일 여부를 예측하는 방법을 제시하였다. 일반적인 악성코드의 구조를 갖는 Portable Executable 구조 파일을 파이썬의 LIEF 라이브러리를 사용하여 Certificate, Imports, Opcode 등 3가지 feature에 대해 정적분석을 하였다. 학습 데이터로는 정상파일 320개와 악성파일 530개를 사용하였다. Certificate는 hasSignature(디지털 서명정보), isValidcertificate(디지털 서명의 유효성), isNotExpired(인증서의 유효성)의 feature set을 사용하고, Imports는 Import Address Table의 function 빈도수를 비교하여 feature set을 구축하였다. Opcode는 tri-gram으로 추출하여 빈도수를 비교하여 feature set을 구축하였다. 테스트 데이터로는 정상파일 360개 악성파일 610개를 사용하였으며 Feature set을 사용하여 random forest, decision tree, bagging, adaboost 등 4가지 머신러닝 알고리즘을 대상으로 성능을 비교하였고, bagging 알고리즘에서 약 0.98의 정확도를 보였다.

  • PDF

The Distribution and Standing Crop of Phytoplankton of Lagoons in the East Coast of Korea (동해안 석호의 식물플랑크톤 분포와 현존량)

  • 문병렬;이옥민
    • Korean Journal of Environmental Biology
    • /
    • v.20 no.4
    • /
    • pp.325-338
    • /
    • 2002
  • The distribution and standing crop of phytoplankton were investigated at 12 stations of Songjiho, Ssangho, Maeho and Hyangho as of four lagoons in the east coast from May to November, 2001. It turned out to be total of 164 taxa, and classified as four phylums, four classes, 14 orders, 20 families, 59 genera, 139 species, 22 varieties, two forms and 1 unidentified species by Engler's classification system. Among 104 taxa, 16 taxa including Oscillatoria chlorina were identified as indicators of water pollution and only Cocconeis placentula was the indicator of the clean water. Standing crops of all stations investigated appeared to be relatively high values. Based on the present study upon the distribution and standing crop of phytoplankton, it is regarded as the state of the eutrophication in Songjiho, Ssangho, Maeho and Hyangho as of four lagoons in the east coast.

A Study on the Pisolite of Limstone Caverns in Korea (석회암동굴과 위종유동에서 발견된 Pisolite 변종에 관한 연구)

  • Suh, Moo-Song
    • Journal of the Speleological Society of Korea
    • /
    • no.90
    • /
    • pp.9-15
    • /
    • 2009
  • The pisolite of the limstone caverns in korea is one of the varieties of speleology. the main component of the pisolite is calcite, butpisolite often contains quartz and ilite too. the mechanism of encrusting is complicated,but the main process is the accretion which is supposed to take place as fast as 2mmper century.