• The Journal of Korean Association of Computer Education
• /
• v.13 no.6
• /
• pp.91-98
• /
• 2010

NAC(Network Access Control) has been developed as a solution for the security of end-point user, to be a target computer of worm attack which does not use security patch of OS and install Anti-Virus, which spreads the viruses in the Intra-net. Currently the NAC products in market have a sufficient technology of pre-connect, but insufficient one of post-connect which detects the threats after the connect through regular authentication. Therefore NAC users have been suffered from Zero-day attacks and malware infection. In this paper, to solve the problems in the post-connect step we generate the normal behavior profiles using the traffic information of each host, host information through agent, information of open port and network configuration modification through network scanner addition to authentication of host and inspection of policy violation used before. Based on these we propose the system to detect the hosts infected malware.

• The KIPS Transactions:PartC
• /
• v.16C no.5
• /
• pp.555-562
• /
• 2009

In malware accident investigation, the most important thing is detection of malicious code. Signature based anti-virus softwares have been used in most of the accident. Malware can easily avoid signature based detection by using packing or encryption method. Because of this, packed file detection is also important. Detection methods can be divided into signature based detection and entropy based detection. Signature based detection can not detect new packing. And entropy based detection has a problem with false positive. We provides detection method using entropy statistics of entry point section and 'write' properties of essential characteristic of packed file. And then, we show packing detection tool and evaluate its performance.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.3
• /
• pp.549-555
• /
• 2019

According to a recent report by anti-virus vendors, the number of new and modified malware increased exponentially. Therefore, malware analysis research using machine learning has been actively researched in order to replace passive analysis method which has low analysis speed. However, when using supervised learning based machine learning, many studies use low-reliability malware family name provided by the antivirus vendor as the label. In order to solve the problem of low-reliability of malware label, this paper introduces a new labeling technique, "Unified Labeling", and further verifies the malicious behavior similarity through the feature analysis of the fine-grained method. To verify this study, various clustering algorithms were used and compared with existing labeling techniques.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.2
• /
• pp.321-330
• /
• 2015

There have been found many modified malwares which could avoid detection simply by replacing a sequence of characters or a part of code. Since the existing anti-virus program performs signature-based analysis, it is difficult to detect a malware which is slightly different from the well-known malware. This paper suggests a method of detecting modified malwares by extending a hash-value based code comparison. We generated hash values for individual functions and individual code blocks as well as the whole code, and thus use those values to find whether a pair of codes are similar in a certain degree. We also eliminated some numeric data such as constant and address before generating hash values to avoid incorrectness incurred from them. We found that the suggested method could effectively find inherent similarity between original malware and its derived ones.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.5
• /
• pp.1087-1097
• /
• 2017

As the penetration rate of smartphones increases, the number of malicious codes targeting smartphones is increasing. I 360 Security 's smartphone malware statistics show that malicious code increased 437 percent in the first quarter of 2016 compared to the fourth quarter of 2015. In particular, malicious applications, which are the main means of distributing malicious code on smartphones, are aimed at leakage of user information, data destruction, and money withdrawal. Often, it is operated by an API, which is an interface that allows you to control the functions provided by the operating system or programming language. In this paper, we propose a mechanism to detect malicious application based on the similarity of API pattern in normal application and malicious application by learning pattern of API in application derived from static analysis. In addition, we show a technique for improving the detection rate and detection rate for each label derived by using the corresponding mechanism for the sample data. In particular, in the case of the proposed mechanism, it is possible to detect when the API pattern of the new malicious application is similar to the previously learned patterns at a certain level. Future researches of various features of the application and applying them to this mechanism are expected to be able to detect new malicious applications of anti-malware system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.6
• /
• pp.1341-1351
• /
• 2015

As the popularization of smartphone increases the number of various applications, the number of malicious applications also grows rapidly through the third party App Market or black market. This paper suggests an investigation filter, Androfilter, that detects the fabrication of APK file effectively. Whereas the most of antivirus software uses a separate server to collect, analyze, and update malicious applications, Androfilter assumes Google Play as the trusted party and verifies integrity of an application through a simple query to Google Play. Experiment results show that Androfilter blocks brand new malicious applications that have not been reported yet as well as known malicious applications.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.04a
• /
• pp.246-249
• /
• 2017

악성코드 분석을 실제머신에서 진행하는 도중 시스템이 손상될 경우 복원에 어려움이 있다. 이에 따라 역공학 분석가들은 일반적으로 가상환경에서 분석을 진행한다. 가상환경의 경우 실제머신 호스트 운영체제와는 독립되어 있고 악성코드를 발현하여 시스템이 손상이 되더라도 이전 스냅 샷으로 복원하는 것이 용이하기 때문에 가상환경에서 악성행위 동작을 분석한다. 하지만, 최근 들어 악성코드가 점점 지능화되고 있으며 이에 따라 악성코드가 VM(Virtual Machine)환경에서는 동작하지 않는 Anti-VM 기술이 적용된 악성코드가 증가하고 있다. 따라서, 본 논문에서는 가상환경에서 Anti-VM 기술이 적용된 악성코드를 분석할 수 있는 위한 환경 연구를 진행한다. 이에 따라, 악성코드가 가상환경을 탐지하는 기법을 분석하고 각 탐지기법을 방지할 수 있는 방안을 제안한다. 이를 통해 동적분석을 하지 못하도록 하는 분석 방해 지연 기술 중 하나인 Anti-VM 기술이 적용된 악성코드의 분석 결과를 향상 시키는 것을 목표로 한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.11a
• /
• pp.405-408
• /
• 2014

유무선 인터넷이 보편화되고 이용이 확산되면서 금융권에서는 고객의 편의성 증진을 위해 영업점의 상당한 업무를 인터넷뱅킹과 모바일뱅킹 등을 이용하여 처리할 수 있는 IT환경을 제공하고 있다. 이러한 Endpoint 환경의 변화는 점점 더 지능화되고 있는 사이버 공격 기술로 보안 위협이 증대되고 있는 실정이다. 이를 해결하기 위한 방법 중의 하나로 본 연구에서는 Reverse sandboxing 기술과 화이트리스트 기반의 보안 기술이 내장된 커널 수준의 TSX(Trusted Security Extension)기술을 통하여 맬웨어가 감염된 상태에서도 안전하게 전자금융거래를 할 수 있는 Endpoint 환경을 제공한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.5
• /
• pp.1119-1127
• /
• 2018

Most of the cyber attacks are caused by malicious codes. The damage caused by cyber attacks are gradually expanded to IoT and CPS, which is not limited to cyberspace but a serious threat to real life. Accordingly, various malicious code analysis techniques have been appeared. Dynamic analysis have been widely used to easily identify the resulting malicious behavior, but are struggling with an increase in Anti-VM malware that is not working in VM environment detection. On the other hand, static analysis has difficulties in analysis due to various packing techniques. In this paper, we proposed malware classification techniques regardless of known packers or unknown packers through the proposed model. To do this, we designed a model of supervised learning and unsupervised learning for the features that can be used in the PE structure, and conducted the results verification through 98,000 samples. It is expected that accurate analysis will be possible through customized analysis technology for each class.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.5
• /
• pp.847-859
• /
• 2023

With the recent increase in damage caused by malcious codes using software vulnerabilities in Korea, it is essential to install anti-virus to prevent malicious codes, However, it is not easy for general users to know which anti-virus product has good performance or whether it is suitable for their environment. There are many institutions that provide information on anti-virus performance outside of korea, and these institutions have established their own test environments and test evaluation items, but they do not disclose detailed test environment information, detailed test evaluation items, and results. In addition, existing quality evaluation studies are not suitable for the evaluating the latest anti-virus products because there are many evaluation criteria that do not meet anti-virus product evaluation. Therefore, this paper establishes detailed anti-virus evaluation metrics suitable for the latest anti-virus evaluation and applies them to 9 domestic and foreign anti-virus products to verify the functions and performance of anti-viruses.