程序自动脱壳数据采集技术研究

自动提取加壳程序隐藏的代码和数据是目前恶意代码检测技术面临的重要问题。分析了加壳程序运行的本质特征,给出了存储器监控算法和动态基本块标记算法,描述了基于QEMU仿真器的程序自动脱壳数据采集系统的设计思路。实验结果表明,该系统可以有效地提取被加壳程序的代码和数据,完整地记录程序脱壳的执行行为。     

基于数据挖掘技术的加壳PE程序识别方法

恶意代码大量快速的繁衍使得恶意代码自动化检测成为必然趋势,加壳程序识别是恶意代码分析的一个必要步骤。为识别加壳可执行程序,提出一种基于数据挖掘技术的自动化加壳程序识别方法,该方法提取和选取可移植可执行(PE)特征,使用分类算法检测PE文件是否加壳。测试结果表明,在使用J48分类器时加壳文件识别率为98.7%。     

基于虚拟机架构的自修改代码监测技术

自修改代码技术是恶意程序用以防止反汇编静态分析的最常见技术。传统操作系统的恶意代码防范技术不能有效监测和防止自修改恶意代码的执行和传播。介绍了一个基于虚拟机架构对自修改代码进行监测和监控的方法CASMonitor,能够从虚拟机外部动态、透明地监控虚拟机内部指定程序的执行过程,监测代码的自修改行为,解析新生成代码的入口点,进而提供病毒扫描等功能。x86/Win32虚拟机架构下的实验表明,该技术能够处理多种自修改代码行为以及常见的加壳工具。     

自动的恶意代码动态分析系统的设计与实现

现代的恶意代码采用多态和加壳等方法来隐藏自己,使得恶意代码的分析检测变得越来越困难.传统的手工分析需要耗费大量时间和人力,不能满足恶意代码分析的需要.本文设计实现的自动化恶意代码动态分析系统MwDAS,可以自动地对恶意代码样本进行快速的动态分析,通过Kernel Hooking和Filter Driver技术在内核态提取其行为特征,生成详细的分析报告.实验结果表明MwDAS可以提高恶意代码的分析效率.     

恶意代码自动脱壳技术研究

恶意程序普遍使用一些高级的软件保护技术躲避检测工具等的查杀,而复杂的程序加壳技术就是其中的典型代表,必须对其进行脱壳操作才能进行彻底的分析。文章以对壳程序特征的分析为基础,提取样本程序的外壳特征,自动提取加壳程序隐藏的代码和数据,并提出了基于动态分析平台的自动脱壳系统的设计方案。实验结果表明,该系统可以有效处理常见的外壳程序类型,一方面提高了脱壳技术的自动化程度,另一方面大大增强了脱壳技术的通用性。     

基于卷积神经网络与多特征融合恶意代码分类方法

为了减小加壳、混淆技术对恶意代码分类的影响并提高准确率,提出一种基于卷积神经网络和多特征融合的恶意代码分类方法,以恶意代码灰度图像和带有API函数调用与操作码的混合序列为特征,设计基于卷积神经网络的多特征融合分类器。该分类器由图像组件、序列组件和融合组件构成,经训练后用于检测恶意代码类别。实验结果表明,相比目前已有的HYDRA、Orthrus等方法,该方法的分类准确率和宏F₁值更高,表明该方法能减小加壳、混淆技术影响,更准确地分类恶意代码。     

一种面向图神经网络安卓恶意代码检测的通用解释定位方法

面对不断涌现的安卓恶意应用,虽然大量研究工作采用图神经网络分析代码图实现了准确高效的恶意应用检测,但由于未提供应用内恶意代码的具体位置信息,难以对后续的人工复核工作提供有效帮助.可解释技术的出现为此问题提供了灵活的解决方法,在基于不同类型神经网络及代码特征表示实现的检测模型上展示出了较好的应用前景.本研究聚焦于基于图神经网络的安卓恶意代码检测模型上,使用可解释技术实现安卓恶意代码的准确定位:（1）提出了基于敏感API及多关系图特征的敏感子图提取方法.根据敏感API,控制流逻辑以及函数调用结构三类特征与恶意代码子图分布的关联性,细致刻画恶意代码特征,精简可解释技术关注的代码图规模;（2）提出了基于敏感子图输入的可解释技术定位方法.使用基于扰动原理的可解释技术,在不改变检测模型结构的情况下对代码图边缘进行恶意性评分,为各类基于图神经网络安卓恶意代码检测提供解释定位;（3）设计实验验证敏感子图提取对于与恶意代码特征的刻画效果以及基于敏感子图提取的解释定位效果.实验结果显示,本文的敏感子图提取方法相较于MsDroid固定子图半径的方法更为精确,能够为可解释技术提供高质量的输入;基于此方法改进后得到的可解释技术定位方法相较于GNNExplainer通用解释器及MsDroid定位方法,在保证定位适用性和效率的同时,恶意代码平均定位准确率分别提高了8.8%和2.7%.     

基于PSO-KM聚类分析的通信网络恶意攻击代码检测方法

恶意代码的快速发展严重影响到网络信息安全,传统恶意代码检测方法对网络行为特征划分不明确,导致恶意代码检测的结果不够精准,研究基于PSO-KM聚类分析的通信网络恶意攻击代码检测方法。分析通信网络中恶意攻击代码的具体内容,从网络层流动轨迹入手提取网络行为,在MFAB-NB框架内确定行为特征。通过归一化算法选择初始处理中心,将分类的通信网络行为特征进行归一化处理,判断攻击速度和位置。实时跟进通信网络数据传输全过程,应用适应度函数寻求恶意代码更新最优解。基于PSO-KM聚类分析技术构建恶意代码数据特征集合,利用小批量计算方式分配特征聚类权重,以加权平均值作为分配依据检测恶意攻击代码,实现检测方法设计。实验结果表明：在本文方法应用下对恶意攻击代码检测的正确识别率可以达到99%以上,误报率可以控制在0.5%之内,具有应用价值。     

基于图标相似性分析的恶意代码检测方法

据统计，在大量的恶意代码中，有相当大的一部分属于诱骗型的恶意代码，它们通常使用与常用软件相似的图标来伪装自己，通过诱骗点击达到传播和攻击的目的。针对这类诱骗型的恶意代码，鉴于传统的基于代码和行为特征的恶意代码检测方法存在的效率低、代价高等问题，提出了一种新的恶意代码检测方法。首先，提取可移植的执行体（PE）文件图标资源信息并利用图像哈希算法进行图标相似性分析；然后，提取PE文件导入表信息并利用模糊哈希算法进行行为相似性分析；最后，采用聚类和局部敏感哈希的算法进行图标匹配，设计并实现了一个轻量级的恶意代码快速检测工具。实验结果表明，该工具对恶意代码具有很好的检测效果。     

一种面向环境识别的恶意代码完整性分析方法

完整性分析一直是恶意代码动态分析的难点。针对恶意代码动态分析方法存在行为获取不完整的问题,提出了一种面向环境识别的恶意代码完整性分析方法,通过分析恶意代码执行过程中的数据流信息识别恶意代码敏感分支点,构造能够触发隐藏行为的执行环境,提高了恶意代码行为分析的完整程度。通过对50个恶意代码样本的分析结果表明,该方法能有效缩减分析时间,获得更加全面的行为信息,有效提高分析效率和分析的完整性。     

Packer identification using Byte plot and Markov plot

Malware is one of the major concerns in computer security. The availability of easy to use malware toolkits and internet popularity has led to the increase in number of malware attacks. Currently signature based malware detection techniques are widely used. However, malware authors use packing techniques to create new variants of existing malwares which defeat signature based malware detection. So, it is very important to identify packed malware and unpack it before analysis. Dynamic unpacking runs the packed executable and provides an unpacked version based on the system. This technique requires dedicated hardware and is computationally expensive. As each individual packer uses its own unpacking algorithm it is important to have a prior knowledge about the packer used, in order to assist in reverse engineering. In this paper, we propose an efficient framework for packer identification problem using Byte plot and Markov plot. First packed malware is converted to Byte plot and Markov plot. Later Gabor and wavelet based features are extracted from Byte plot and Markov plot. We used SVMs (Support Vector Machine) in our analysis. We performed our experiments on nine different packers and we obtained about 95 % accuracy for nine of the packers. Our results show features extracted from Markov plot outperformed features extracted from Byte plot by about 3 %. We compare the performance of Markov plot with PEID (Signature based PE identification tool). Our results show Markov plot produced better accuracy when compared to PEID. We also performed multi class classification using Random Forest and achieved 81 % accuracy using Markov plot based features.     

Entropy analysis to classify unknown packing algorithms for malware detection

The proportion of packed malware has been growing rapidly and now comprises more than 80 % of all existing malware. In this paper, we propose a method for classifying the packing algorithms of given unknown packed executables, regardless of whether they are malware or benign programs. First, we scale the entropy values of a given executable and convert the entropy values of a particular location of memory into symbolic representations. Our proposed method uses symbolic aggregate approximation (SAX), which is known to be effective for large data conversions. Second, we classify the distribution of symbols using supervised learning classification methods, i.e., naive Bayes and support vector machines for detecting packing algorithms. The results of our experiments involving a collection of 324 packed benign programs and 326 packed malware programs with 19 packing algorithms demonstrate that our method can identify packing algorithms of given executables with a high accuracy of 95.35 %, a recall of 95.83 %, and a precision of 94.13 %. We propose four similarity measurements for detecting packing algorithms based on SAX representations of the entropy values and an incremental aggregate analysis. Among these four metrics, the fidelity similarity measurement demonstrates the best matching result, i.e., a rate of accuracy ranging from 95.0 to 99.9 %, which is from 2 to 13  higher than that of the other three metrics. Our study confirms that packing algorithms can be identified through an entropy analysis based on a measure of the uncertainty of the running processes and without prior knowledge of the executables.     

基于带权欧拉距离的PE文件壳检测技术

越来越多的恶意软件出现在网络上。恶意软件作者通过网络将软件中的恶意代码植入用户的电脑中,从而达到诸如获得用户名与密码的非法目的。为了阻止它们对用户电脑的侵害,软件分析人员必须分析恶意软件的工作原理。但是,如果这些恶意软件加壳,那么分析它们就会变得非常困难,因此必须对他们进行脱壳。脱壳的第一步即检测这些恶意软件是否加壳。本文通过对未加壳和已经加壳的软件PE头部进行分析与比较,提出了带权欧拉距离PE文件壳检测(PDWED)算法,其中包括构造一个含有10个元素的向量,并为每个向量中每个元素分配一个权重值,计算向量的带权欧拉距离。实验结果表明,PDWED能够比较快速而又准确地检测软件是否加壳。     

Dynamic checking of temporal constraints for concurrent workflows

At present, workflow management systems have not sufficiently dealt with the issues of time, involving time modelling at build-time and time management at run-time. They are lack of the ability to support the checking of temporal constraints at run-time. Although some approaches have been devised to tackle this problem, they are limited to a single workflow and use only static techniques to verify temporal constraints. In reality, there are multiple workflows executing concurrently in a workflow management system. There may well exist resource constraints between these concurrent workflows, which affect significantly the verification of temporal constraints at run-time. This paper proposes a novel approach for dynamic verification of temporal constraints for concurrent workflows. We first investigate resource constraints in workflow management systems, and then define concurrent workflow executions. Based on these definitions, we propose a verification method by analysing the temporal relationship and resource constraints between activities among concurrent workflows.     

基于深度信念网络的Android恶意应用检测方法

传统的机器学习算法无法有效地从海量的行为特征中选择出有本质的行为特征来对未知的Android恶意应用进行检测。为了解决这个问题,提出DBNSel,一种基于深度信念网络模型的Android恶意应用检测方法。为了实现该方法,首先通过静态分析方法从Android应用中提取5类不同的属性。其次,建立深度信念网络模型从提取到的属性中进行选择和学习。最后,使用学习到的属性来对未知类型的Android恶意应用进行检测。在实验阶段,使用一个由3 986个Android正常应用和3 986个Android恶意应用组成的数据集来验证DBNSel的有效性。实验结果表明,DBNSel的检测结果要优于其他几种已有的检测方法,并可以达到99.4%的检测准确率。此外,DBNSel具有较低的运行开销,可以适应于更大规模的真实环境下的Android恶意应用检测。     

一种基于主动学习的恶意代码检测方法

现有恶意代码的检测往往依赖于对足够数量样本的分析.然而新型恶意代码大量涌现,其出现之初,样本数量有限,现有方法无法迅速检测出新型恶意代码及其变种.本文在数据流依赖网络中分析进程访问行为异常度与相似度,引入了恶意代码检测估计风险,并提出一种通过最小化估计风险实现主动学习的恶意代码检测方法.该方法只需要很少比例的训练样本就可实现准确的恶意代码检测,较现有方法更适用于新型恶意代码检测.通过我们对真实的8,340个正常进程以及7,257个恶意代码进程的实验分析,相比于传统基于统计分类器的检测方法,本文方法明显地提升了恶意代码检测效果.即便在训练样本仅为总体样本数量1%的情况下,本文方法可以也可达到5.55%的错误率水平,比传统方法降低了36.5%.     

Anti-emulation trends in modern packers: a survey on the evolution of anti-emulation techniques in UPA packers

Writing modern day executable packers has turned into a rather profitable business. In many cases, the reason for packing is not protecting genuine applications against piracy or plagiarism, but rather avoiding reverse-engineering and detection of malicious samples. Unlike developers, which show moderate interest for using a packer and lack time and resources for creating one, malware creators show a huge interest and are willing to spend large amounts of money to use this technology (especially if it offers protection against security solutions). This happens mainly because protecting from piracy and plagiarism isn’t that profitable as spreading new and undetected malware on as many computers as possible. Consequently, creating a custom packer designed to avoid malware detection has grown into a very profitable business.However, developing a good packer is not an easy task to accomplish. Novel techniques of achieving anti-static analysis, anti-virtual machine, anti-sandbox, anti-emulation, anti-debugging, anti-patching, and so on, have to be discovered and added regularly. From the malware creator’s perspective, this must happen frequently enough so that the updates are issued shortly after malware researchers analyze and bypass the existing mechanisms because, once these techniques are bypassed, the detection rate increases in the case of the malware samples packed with the old version of the packer.In this paper, we present our findings which resulted from closely monitoring the fight between malware researchers and packer developers during a period of almost two years. We focus on three different packers used for prevalent malware families like Upatre, Gamarue, Hedsen. We named those packers UPA 1, UPA 2, and UPA 3 and we discuss the mechanisms used in them to achieve anti-emulation. Each technique is presented by listing the code and explaining the inner workings in details. In the end, we manage to get a grasp of the current trends in achieving anti-emulation when developing modern packers.     

基于混合策略的轮式机器入路径规划方法

快速扩展随机树方法（R RT）是解决具有非完整性约束的轮式机器人路径规划问题的一种有效途径。R RT能够在规划过程中引入机器人动力学约束,但是当环境中存在大量障碍物时,R RT算法的路径搜索效率将会降低。另一方面,R RT算法不具有最优性,限制了其在轮式机器人路径规划中的应用。针对经典R RT算法的不足,提出一种混合的路径规划策略,首先通过路径导引点扩展多树R RT结构,利用多树R RT的局部探索与合并特性快速寻找可通行的区域范围,利用启发式搜索算法在可通行区域内快速寻找动力学可行的机器人运动轨迹。仿真与实车实验表明,该方法能够快速有效地解决复杂障碍物环境下的机器人路径规划问题。