• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.457-459
• /
• 2004

최근 악성코드들의 주요한 특징 중 하나는 악성코드와 해킹기법이 결합된 형태이며 기존의 악성코드들 보다 더욱 공격 성향을 내포하고 있다는 점이다. 이러한 악성코드에는 대표적으로 IRC를 이용하는 Bot 계열 악성 코드들이 있으며 해킹과 결합되어 그 피해 또한 스팸성 악성코드들보다 심각하다. 또한 이러한 악성코드들은 다양한 변종이 신속하게 제작 및 유포되고 있어, 백신을 이용한 방어만으로는 적절히 대처할 수 없다는 문제점을 가지고 있다. 본 논문에서는 IRC를 이용하는 공격성 악성코드들을 분석하고, 이들 악성코드들을 효과적으로 탐색하여 감염 여부를 판단할 수 있는 악성 Bot 탐색 시스템의 설계 및 구현에 관하여 기술한다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2017.01a
• /
• pp.207-208
• /
• 2017

악성코드는 매년 그 수가 증가하고 있으며, 악성코드의 공격기법이 지능적이고 복합적으로 진화함에 따라 이에 대한 분석과 대응이 요구된다. 하지만 일부 악성코드는 감염여부를 숨기기 위하여 분석에 대한 회피방법으로 루트킷을 통하여 방어자에 의한 악성코드의 코드 분석을 우회함으로써 은폐된 상태로 악의적인 공격을 수행한다. 따라서 본 논문에서는 유저레벨에서 IAT(Import Address Table)의 정보를 후킹하여 악성 행위를 수행하는 루트킷을 탐지하는 대응방안을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.1
• /
• pp.117-124
• /
• 2016

Virtual environment is widely used for analyzing malware which is increasing very rapidly. However, knowing this trend, hackers are adopting virtual environment detection techniques for malware to kill itself or stop malicious behaviors when detecting virtual environments. Various research is going on in order to thwart any efforts to utilize anti-virtualization techniques, but until now several techniques can evade most of well known virtual environments, making malware analysis very difficult. Emulab developed by Utah University assigns real systems and networks as researchers want in realtime. This research seeks how to use Emulab for malware analysis.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.2
• /
• pp.377-386
• /
• 2016

As the number of malware has been increased, it is necessary to analyze malware rapidly against cyber attack. Additionally, Dynamic malware analysis has been widely studied to overcome the limitation of static analysis such as packing and obfuscation, but still has a problem of exploring multiple execution path. Previous works for exploring multiple execution path have several problems that it requires much time to analyze and resource for preparing analysis environment. In this paper, we proposed efficient exploring approach for multiple execution path in a single analysis environment by pipelining processes and showed the improvement of speed by 29% in 2-core and 70% in 4-core through experiment.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2021.05a
• /
• pp.212-215
• /
• 2021

본 논문에서는 딥러닝의 CNN(Convolution Neural Network) 학습을 통하여 악성코드를 실행시키지 않고서 악성코드 변종을 패밀리 그룹으로 분류하는 방법을 연구한다. 먼저 데이터 전처리를 통해 3가지의 서로 다른 방법으로 악성코드 이미지와 메타데이터를 생성하고 이를 CNN으로 학습시킨다. 첫째, 악성코드의 byte 파일을 8비트 gray-scale 이미지로 시각화하는 방법이다. 둘째, 악성코드 asm 파일의 opcode sequence 정보를 추출하고 이를 이미지로 변환하는 방법이다. 셋째, 악성코드 이미지와 메타데이터를 결합하여 분류에 적용하는 방법이다. 이미지 특징 추출을 위해서는 본고에서 제안한 CNN을 통한 학습 방식과 더불어 3개의 Pre-trained된 CNN 모델을 (InceptionV3, Densnet, Resnet-50) 사용하여 전이학습을 진행한다. 전이학습 시에는 마지막 분류 레이어층에서 본 논문에서 선택한 데이터셋에 대해서만 학습하도록 파인튜닝하였다. 결과적으로 가공된 악성코드 데이터를 적용하여 9개의 악성코드 패밀리로 분류하고 예측 정확도를 측정해 비교 분석한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.984-987
• /
• 2011

모바일 보안이 이슈화 됨에 따라 안티 바이러스 소프트웨어를 제공하는 벤더들은 시그니쳐 기반의 모바일 안티 바이러스 제품들을 제공하고 있다. 시그니쳐 기반의 악성코드 탐지 방식은 새로운 방식의 악성코드를 탐지 하지 못하는 단점 때문에, 악성코드 행위 자체를 분석하는 악성코드 동적 및 혼합분석이 연구되고 있다. 본 논문에서는 자원의 제약이 있는 모바일 플랫폼에서 동적 행위 분석 및 정적분석을 혼합한 혼합 분석을 클라우드 환경에서 처리하는 프레임워크를 제안하고자 한다.

• Journal of the Korea Society of Computer and Information
• /
• v.25 no.11
• /
• pp.123-129
• /
• 2020

Recently, cybercrime has become increasingly difficult to track by applying new technologies such as virtualization technology and distribution tracking avoidance. etc. Therefore, there is a limit to the technology of tracking distributors based on malicious code information through static and dynamic analysis methods. In addition, in the field of cyber investigation, it is more important to track down malicious code distributors than to analyze malicious codes themselves. Accordingly, in this paper, we propose a next-generation malicious code information collection architecture to efficiently track down malicious code distributors by converging traditional analysis methods and recent information collection methods such as OSINT and Intelligence. The architecture we propose in this paper is based on the differences between the existing malicious code analysis system and the investigation point's analysis system, which relates the necessary elemental technologies from the perspective of cybercrime. Thus, the proposed architecture could be a key approach to tracking distributors in cyber criminal investigations.

• Journal of the Korea Society of Computer and Information
• /
• v.14 no.9
• /
• pp.47-54
• /
• 2009

Malicious codes, which are spread through WWW are now evolved with various hacking technologies However, detecting technologies for them are seemingly not able to keep up with the improvement of hacking and newly generated malicious codes. In this paper, we define the requirements of detecting systems based on the analysis of malicious codes and their spreading characteristics, and propose an improved detection scheme which monitors HTTP Outbound traffic and detects spreading malicious codes in real time. Our proposed scheme sets up signatures in IDS with confirmed HTML tags and Java scripts which spread malicious codes. Through the verification analysis under the real-attacked environment, we show that our scheme is superior to the existing schemes in satisfying the defined requirements and has a higher detection rate for malicious codes.

• Convergence Security Journal
• /
• v.19 no.3
• /
• pp.37-41
• /
• 2019

Recently, due to the appearance of various types of malware, the existing static analysis exposes many limitations. Static analysis means analyzing the structure of a code or program with source code or object code without actually executing the (malicious) code. On the other hand, dynamic analysis in the field of information security generally refers to a form that directly executes and analyzes (malware) code, and compares and examines and analyzes the state before and after execution of (malware) code to grasp the execution flow of the program. However, dynamic analysis required analyzing huge amounts of data and logs, and it was difficult to actually store all execution flows. In this paper, we propose and implement a preprocessor architecture of a system that performs malware detection and real-time multi-dynamic analysis based on 2nd generation PT in Windows environment (Windows 10 R5 and above).

• Journal of the Korea Convergence Society
• /
• v.8 no.5
• /
• pp.37-43
• /
• 2017

A registry is a hierarchy database which is designed to store information necessary for operating system and application programs in Windows operating system, and it is involved in all activities such as booting, logging, service execution, application execution, and user behavior. Digital forensic is widely used. In recent years, malicious codes have penetrated into systems in a way that is not recognized by the user, and valuable information is leaked or stolen, causing financial damages. Therefore, this study proposes a method to detect malicious code by using a shareware application without using expensive digital forensic program, so as to analysis hacking methods and prevent hacking damage in advance.