• The KIPS Transactions:PartC
• /
• v.9C no.5
• /
• pp.765-774
• /
• 2002

Analyzing the code using static heuristics is a widely used technique for detecting unknown malicious codes. It decides the maliciousness of a code by searching for some fragments that had been frequently found in known malicious codes. However, in script codes, it tries to search for sequences of method calls, not code fragments, because finding such fragments is much difficult. This technique makes many false alarms because such method calls can be also used in normal scripts. Thus, static heuristics for scripts are used only to detect malicious behavior consisting of specific method calls which is seldom used in normal scripts. In this paper. we suggest a static analysis that can detect malicious behavior more accurately, by concerning not only the method calls but also parameters and return values. The result of experiments show that malicious behaviors, which were difficult to detect by previous works, due to high false positive, will be detected by our method.

• Journal of KIISE:Information Networking
• /
• v.29 no.6
• /
• pp.663-673
• /
• 2002

Server-side anti-viruses are useful to protect their domains, because they can detect malicious codes at the gateway of their domains. In prevailing local network, all clients cannot be perfectly controlled by domain administrators, so server-side inspection, for example in e-mail server, is used as an efficient technique of detecting mobile malicious codes. However, current server-side anti-virus systems perform only signature-based detection for known malicious codes, simple filtering, and file name modification. One of the main reasons that they don't have detection features, for unknown malicious codes, is that activity monitoring technique is unavailable for server machines. In this paper, we propose a detection technique that is executed at the server, but it can monitor activities at the clients without any anti-virus features. we describe its implementation.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.11b
• /
• pp.1091-1094
• /
• 2002

현재 안티바이러스 시스템에서는 시그너쳐를 기반으로 하는 탐지 방법을 사용하거나 간단한 휴리스틱 검색을 이용 하지만, 이러한 방법은 알려지지 않은 새로운 악성 코드에 대해서는 취약하기 때문에 행위 감시 기반의 감지 방법이 추가적으로 사용된다. 그러나 행위 감시 기반의 안티바이러스 시스템을 대부분의 호스트에 설치하는 일은 많은 어려움이 있다. 이에 따라 안티바이러스 시스템이 설치되지 않은 호스트에서의 행위 감시를 위한 코드 삽입 기법이 제시 되었으나 아직 코드 삽입 기법이 거시적인 과점에서 전체 도메인에 미치는 영향에 대한 연구가 되어 있지 않다. 본 논문은 시뮬레이션을 통하여 코드 삽입 기법이 전체 도메인 상에서 악성 코드의 감지에 미치는 영향을 보여준다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.11a
• /
• pp.695-697
• /
• 2013

스마트폰은 급소도록 보급이 확대됨에 따라 악성코드로 인한 정보보안 침해사례가 급증함에 따라 다양한 형태로 사회적 문제들이 발생하고 있다. 최근 악성코드는 컴퓨터뿐만 아니라 스마트폰, 스마트 TV등 다양한 방면으로 무선인터넷 환경, OS 플랫폼의 개방성, 오픈마켓의 위험성, 도난 및 분실로 급증하고 있다. 이로 인해 개인정보 유출, 과금 부과 등의 피해가 속출 되고 있으며, 악성코드를 감지하는데 어려움이 있다. 본 논문에서는 현재 확산되는 스마트폰 악성코드 종류와 문제점 현황을 살펴보고 대응 방안에 대하여 기술하고자 한다.

• Journal of the Korea Convergence Society
• /
• v.8 no.5
• /
• pp.37-43
• /
• 2017

A registry is a hierarchy database which is designed to store information necessary for operating system and application programs in Windows operating system, and it is involved in all activities such as booting, logging, service execution, application execution, and user behavior. Digital forensic is widely used. In recent years, malicious codes have penetrated into systems in a way that is not recognized by the user, and valuable information is leaked or stolen, causing financial damages. Therefore, this study proposes a method to detect malicious code by using a shareware application without using expensive digital forensic program, so as to analysis hacking methods and prevent hacking damage in advance.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2013.05a
• /
• pp.223-226
• /
• 2013

Information security breaches caused by malicious code is arising in various forms with exponential growth. The latest information security threats on computers are increasing, especially on smartphone, which has enabled malicious code to quickly surge. As a result, the leakage of personal information, such as billing information, is under threat. Meanwhile the attack vector o smartphone malware is difficult to detect. In this paper, we propose a smartphone security system to respond to the spread of malicious code by iPhone and Android OS-based malware analysis.

• Journal of KIISE:Computer Systems and Theory
• /
• v.37 no.5
• /
• pp.304-313
• /
• 2010

There are several methods for malware analyses. However, it is difficult to detect malware exactly with existing detection methods. Especially, malware with strong anti-debugging facilities can detect analyzer and disturb their analyses. Furthermore, it takes too much time to analyze malware. In order to resolve these problems of current analyzers, more improved analysis scheme is required. This paper suggests a dynamic binary instrumentation which supports the instruction analysis and the memory access tracing. Additionally, by supporting the API call tracing with the DLL loading analysis, our system establishes the foundation for analyzing various executable codes. Based on Xen, full-virtualization environment is built using Intel's VT technology. Windows XP can be used as a guest. We analyze representative malware using several functions of our system, and show the accuracy and efficiency enhancements in binary analyses capability of our system.

• KIISE Transactions on Computing Practices
• /
• v.22 no.3
• /
• pp.139-144
• /
• 2016

There exist many threats in cyber space, however current anti-virus software and other existing solutions do not effectively respond to malware that has become more complex and sophisticated. It was shown experimentally that it is possible for the proposed approach to provide an automatic execution environment for the detection of malicious behavior of active malware, comparing the virtual-machine environment with the real-machine environment based on user interaction. Moreover, the results show that it is possible to provide a dynamic analysis environment in order to analyze the intelligent malware effectively, through the comparison of malicious behavior activity in an automatic binary execution environment based on real-machines and the malicious behavior activity in a virtual-machine environment.

• Journal of KIISE:Information Networking
• /
• v.29 no.5
• /
• pp.473-481
• /
• 2002

Decryption of encrypted malicious scripts is essential in order to analyze the scripts and to determine whether they are malicious. An effective decryption technique is one that is designed to consider the characteristics of the script languages rather than the specific encryption patterns. However, currently X-raying and emulation are not the proper techniques for the script because they were designed to decrypt binary malicious codes. In addition to that, heuristic techniques are unable to decrypt unknown script codes that use unknown encryption techniques. In this paper, we propose a new technique that will be able to decrypt malicious scripts based on analytical approach. we describe its implementation.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.4
• /
• pp.829-838
• /
• 2015

As the number of smartphone users have increased, many kinds of malwares have emerged. Unlike existing malwares, spyware can be installed normally after user authentication and agreement according to security policy. For this reason, it is not easy to catch spywares involving harmful functionalities to users by using existing malware detection system. Therefore, our paper focuses on study about detecting mainly wiretapping spywares among them by developing a new wiretapping detection model and application. Specifically, this study conducts to find out power consumption on each application and modular and network consumption to detect voice wiretapping so Open Source Project Power Tutor is used to do this. The risk assessment of wiretapping is measured by gathered all power consumption data from Open Source Project Power Tutor. In addition, developed application in our study can detect at-risk wiretapping spyware through collecting and analyzing data. After we install the application to the smartphone, we collect needed data and measure it.