• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.982-983
• /
• 2011

악성코드의 수가 급격히 늘어나면서, 최근에는 하루에도 수 만개의 신 변종 악성코드가 쏟아져 나온다. 악성코드로 인한 국내 피해를 줄이기 위해 한국인터넷진흥원에서는 신 변종 악성코드를 즉각적으로 분석하고 분석 결과를 공유하기 위해 노력하고 있다. 하지만 악성코드를 정의하고 분류하는 방침에 있어서 표준화된 규칙이 없어 악성 코드 분석 결과를 공유하는 대에 어려움이 따른다. 본 논문에서는 현재의 악성코드 정의 및 분류 방안에 대한 한계점을 개선하기 위해 악성-속성을 규정하고 이를 이용한 악성 코드 정의 및 분류 방안에 대해 제시한다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2014.07a
• /
• pp.67-70
• /
• 2014

최근의 다양한 환경에서 악성코드나 의심 코드에 의한 피해가 날로 늘어나고 있는 추세이며 이를 종합적으로 대응할 수 있는 시스템에 대한 연구가 활발히 이루어지고 있는 상황이다. 이러한 악성코드는 사용자의 동의 없이도 PC에 설치되어 사용자가 인지하지 못하는 피해를 지속적으로 영산하고 있으며 그 심각성도 날로 심해지고 있는 실정이다. 또한 다양한 시스템으로부터 수집되는 방대한 양의 데이터를 실시간으로 처리하고 검증하는 기술 및 탐지 기법을 토대로 악성코드를 탐지하고 분석할 수 있는 대응기술로 고도화 되어야만 한다. 이러한 악성코드는 사용자의 PC에 설치되기 이전부터 검사 및 판단하여 사전 대응하는 것이 매우 중요하다. 본 논문에서는 이러한 악성코드가 실제 PC상에 설치되기 이전에 탐지할 수 있는 기법을 제시하며 이를 장치형태로 검증하였다. 본 논문에서 제시하는 기술을 토대로 악상코드 근절에 대한 근본적인 대안을 제시할 것이라 판단한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2015.04a
• /
• pp.376-379
• /
• 2015

최근 발생한 다양한 해킹 사건에서와 같이, 신규 또는 알려지지 않은 악성코드를 이용한 지능형 지속 공격이 점차 증가하고 있다. 기존의 악성 코드가 해커의 단순한 호기심이나 해커 자신의 능력을 과시하기 위해 제작되어 불특정 다수를 공격했다면, 최근의 해킹 사건에서 사용된 악성코드는 오직 특정 대상만을 목표로 하여 제작, 사용되고 있는 것이 특징이다. 현재 대다수의 악성코드 탐지 방식인 블랙리스트 기반의 시그니처에 의한 탐지방식에서는 악성코드의 일부분이라도 변경이 되면 해당 악성코드를 탐지할 수가 없기 때문에 신규 악성 코드를 탐지하고 대응하는 것이 어렵다. 그러므로 지능형 지속 공격에 대응하기 위해서는 새로운 형태의 파일 탐지 기술이 필요하다. 이에 본 논문에서는 파일의 다양한 속성 및 사용자 분포에 따른 평판점수를 통해 신규 악성코드를 탐지하는 기법을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.4
• /
• pp.679-694
• /
• 2013

According to the national information security white paper 2013, the number of hacking attempt in 2012 is 17,570 which is increased by 67.4% than in 2011, and it has been increasing year after year. The cause of this increase is considered as pursuit of monetary profit and diversification techniques of infection. However, because the development of malicious code faster than the increase in the number of experts to analyze and respond the malware, it is difficult to respond to security threats due to malicious code. So, the interest on automatic analysis tools is increasing. In this paper, we proposed the method of malware classification by similarity using malware DNA. It helps the experts to reduce the analysis time, to increase the correctness. The proposed method generates 'Malware DNA' from extracted features, and then calculates similarity to classify the malwares.

• Informatization Policy
• /
• v.24 no.4
• /
• pp.68-78
• /
• 2017

Malicious codes are currently becoming more complex and diversified, causing various problems spanning from simple information exposure to financial or psychologically critical damages. Even though many researches have studied using reverse engineering to detect these malicious codes, malicious code developers also utilize bypassing techniques against the code analysis to cause obscurity in code understanding. Furthermore, rootkit techniques are evolving to utilize such bypassing techniques, making it even more difficult to detect infection. Therefore, in this paper, we design the analysis process as a more agile countermeasure to malicious codes that bypass analysis techniques. The proposed analysis process is expected to be able to detect these malicious codes more efficiently.

• KIISE Transactions on Computing Practices
• /
• v.21 no.3
• /
• pp.263-268
• /
• 2015

Malware variations could be defined as malicious executable files that have similar functions but different structures. In order to classify the variations, this paper analyzed sequence alignment, the method used in Bioinformatics. This method found common parts of the Malwares' API call information. This method's performance is dependent on the API call information's length; if the length is too long, the performance should be very poor. Therefore we removed the repeated patterns in API call information in order to improve the performance of sequence alignment analysis, before the method was applied. Finally the similarity between malware was analyzed using sequence alignment. The experimental results with the real malware samples were presented.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2013.10a
• /
• pp.127-130
• /
• 2013

Apple's iPhone was released and the SmartPhone craze started in the world. Then, Many kind of SmartPhone released on the market, the number of subscribers increased explosively for the convenience of SmartPhone. By SmartPhone users increases rapidly, the number of Malware targeting SmartPhones increased explosively. The SmartPhone Malware, tend to increase explosively in 2012 beginning to be discovered in earnest from the second half of 2011, and is continuously increasing even now. In this paper, describes the status and trends of SmartPhone Malware, through the analysis of trends in the SmartPhone Malware, we describe the future prospects of SmartPhone Malware.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2017.05a
• /
• pp.434-437
• /
• 2017

After the first malware, the brain virus, was founded in 1986, various types of malwares have been created Including worm, dropper, trojan, backdoor, rootkit and downloader. Especially in recent years, driver-type malware have made then more difficult to analyze. therefore, malware analyst require competitive skills. To analyze malware well, you need to know how it works and have to do it by yourself. So in this paper, we develop the dropper, backdoor, trojan, rootkit and driver similar to malware distributed in the real world. It shows the execution behavior on the virtual environment system We propose a method to analyze malware quickly and effectively with static analysis and dynamic analysis.

• Journal of Convergence for Information Technology
• /
• v.11 no.11
• /
• pp.137-142
• /
• 2021

Although the internet has gained many conveniences and benefits, it is causing economic and social damage to users due to intelligent malware. Most of the signature-based anti-virus programs are used to detect and defend this, but it is insufficient to prevent malware variants becoming more intelligent. Therefore, we proposes a model that detects and defends the intelligent malware that is pouring out in the paper. The proposed model learns by imaging the characteristics of malware based on deeplearning, and detects newly detected malware variants using the learned model. It was shown that the proposed model detects not only the existing malware but also most of the variants that transform the existing malware.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2021.05a
• /
• pp.555-556
• /
• 2021

In this paper, we propose a malware family classification scheme using malware visualization and transfer learning. The malware can be easily reused or modified. However, traditional malware detection techniques are vulnerable to detecting variants of malware. Malware belonging to the same class are converted into images that are similar to each other. Therefore, the proposed method can classify malware with a deep learning model that has been verified in the field of image classification. As a result of an experiment using the VGG-16 model on the Malimg dataset, the classification accuracy was over 98%.