• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.35 no.4B
• /
• pp.599-609
• /
• 2010

Korean government has recently abrogated WIPI policy to open domestic mobile phone market to the world, which may result in the influx of foreign smart phones. This circumstance has given users more wide range of choices to buy a product and also has brought benefit to buy mobile phone cheaply. On the other hands, this change might have brought potential danger of mobile malware incidents which have only occurred in foreign countries. There are standardized analysis methods and response guides for computer malwares, not but for mobile malwares in our country. In this paper, we introduce existing mobile malwares and available tools for their analysis. Considering domestic circumstances which might not be properly protected against mobile malwares, we propose analysis methods and response guide of mobile malwares.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2014.07a
• /
• pp.365-367
• /
• 2014

최근 웹 서비스의 증가와 악성코드는 그 수를 판단 할 수 없을 정도로 빠르게 늘어나고 있다. 매년 늘어나는 악성코드는 금전적 이윤 추구가 악성코드의 주된 동기가 되고 있으며 이는 공공기관 및 보안 업체에서도 악성코드를 탐지하기 위한 연구가 활발히 진행되고 있다. 본 논문에서는 실시간으로 패킷을 분석할수 있는 필터링과 웹 크롤링을 통해 도메인 및 하위 URL까지 자동적으로 탐지할 수 있는 악성코드 탐지 시스템을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.181-192
• /
• 2022

The emergence of new malware is incapacitating existing signature-based malware detection techniques., and applying various anti-analysis techniques makes it difficult to analyze. Recent studies related to signature-based malware detection have limitations in that malware creators can easily bypass them. Therefore, in this study, we try to build a machine learning model that can detect and classify the anti-analysis techniques of packers applied to malware, not using the characteristics of the malware itself. In this study, the n-gram opcodes are extracted from the malicious binary to which various anti-analysis techniques of the commercial packers are applied, and the features are extracted by using TF-IDF, and through this, each anti-analysis technique is detected and classified. In this study, real-world malware samples packed using The mida and VMProtect with multiple anti-analysis techniques were trained and tested with 6 machine learning models, and it constructed the optimal model showing 81.25% accuracy for The mida and 95.65% accuracy for VMProtect.

• Information and Communications Magazine
• /
• v.31 no.5
• /
• pp.15-19
• /
• 2014

인터넷의 사용이 증가하며, 웹을 통한 악성코드유포가 주요 위협으로 등장하였다. 본고에서는 인터넷을 통한 악성코드 유포방법 중 가장 대표적 공격방법이 웹 기반 악성코드 유포공격의 특성을 분석한다.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.54 no.2
• /
• pp.76-82
• /
• 2017

Malware, including ransomware to quickly detect, in this study, to provide an analysis method of malicious code through the image analysis that has been learned in the deep learning of artificial intelligence. First, to analyze the 2,400 malware data, and learning in artificial neural network Convolutional neural network and to image data. Extracts subgraphs to convert the graph of abstracted image, summarizes the set represent malware. The experimentally analyzed the malware is not how similar. Using deep learning of artificial intelligence by classifying malware and It shows the possibility of accurate malware detection.

• KIISE Transactions on Computing Practices
• /
• v.21 no.3
• /
• pp.263-268
• /
• 2015

Malware variations could be defined as malicious executable files that have similar functions but different structures. In order to classify the variations, this paper analyzed sequence alignment, the method used in Bioinformatics. This method found common parts of the Malwares' API call information. This method's performance is dependent on the API call information's length; if the length is too long, the performance should be very poor. Therefore we removed the repeated patterns in API call information in order to improve the performance of sequence alignment analysis, before the method was applied. Finally the similarity between malware was analyzed using sequence alignment. The experimental results with the real malware samples were presented.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.1
• /
• pp.105-115
• /
• 2019

Recently, intelligent Android malicious codes have become difficult to detect malicious behavior by static analysis alone. Malicious code with SO file, dynamic loading, and string obfuscation are difficult to extract information about original code even with various tools for static analysis. There are many dynamic analysis methods to solve this problem, but dynamic analysis requires rooting or emulator environment. However, in the case of dynamic analysis, malicious code performs the rooting and the emulator detection to bypass the analysis environment. To solve this problem, this paper investigates a variety of root detection schemes and builds an environment for bypassing the rooting detection in real devices. In addition, SDK code hooking module for Android malicious code analysis is designed using Xposed, and intent tracking for code flow, dynamic loading file information, and various API information extraction are implemented. This work will contribute to the analysis of obfuscated information and behavior of Android Malware.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.5
• /
• pp.933-943
• /
• 2022

As the Internet develops and the utilization rate of computers increases, the threats posed by malware keep increasing. This leads to the demand for a system to automatically analyzes a large amount of malware. In this paper, an automatic malware analysis technique using a deep learning algorithm is introduced. Our proposed method uses CNN (Convolutional Neural Network) to analyze the malicious features represented as images. To reflect semantic information of malware for detection, our method uses the opcode frequency data of binary for image generation, rather than using bytes of binary. As a result of the experiments using the datasets consisting of 20,000 samples, it was found that the proposed method can detect malicious codes with 91% accuracy.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2004.05a
• /
• pp.1193-1196
• /
• 2004

1980년 후반. MIT에 버너스 리 교수가 인터넷 상에 웹(WWW)을 창시하면서부터 우리의 일상생활은 엄청난 변화를 가져왔다. 시 공간을 초월할 수 있는 인터넷이라는 가상 세계에서는 개인뿐만 아니라 정치 경제 사회등 모든 분야에 걸쳐 인터넷을 통한 쉽고 간편하며 빠른 교류가 이루어짐으로써 이제 더 이상 네트워크를 이용하지 않는 분야는 찾아 볼 수 없을 것이다. 그러나 이러한 현실 속에서 인터넷은 항상 순기능만을 수행하지는 않는다. 특히 악성코드를 이용한 사이버 침해 행위 기술이 인터넷의 발전과 함께 동시에 발전함으로써 이제는 악성코드를 이용한 사이버 침해 행위를 방지하고자하는 노력을 해야할 것이다. 따라서 본 논문에서는 악성코드를 탐지하기 위해 실시간 시스템 모니터링 도구를 이용하여 악성코드가 시스템에 어떠한 침해행위를 행하고, 해당 침해 행위 모니터링 로그 분석을 통해 기존의 알려진 악성코드뿐만 아니라 알려지지 않은 악성코드를 탐지할 수 있는 악성 패턴 분석 및 추출에 초점을 두어 기술하였다.

• KIISE Transactions on Computing Practices
• /
• v.22 no.3
• /
• pp.139-144
• /
• 2016

There exist many threats in cyber space, however current anti-virus software and other existing solutions do not effectively respond to malware that has become more complex and sophisticated. It was shown experimentally that it is possible for the proposed approach to provide an automatic execution environment for the detection of malicious behavior of active malware, comparing the virtual-machine environment with the real-machine environment based on user interaction. Moreover, the results show that it is possible to provide a dynamic analysis environment in order to analyze the intelligent malware effectively, through the comparison of malicious behavior activity in an automatic binary execution environment based on real-machines and the malicious behavior activity in a virtual-machine environment.