基于带权欧拉距离的PE文件壳检测技术

越来越多的恶意软件出现在网络上。恶意软件作者通过网络将软件中的恶意代码植入用户的电脑中,从而达到诸如获得用户名与密码的非法目的。为了阻止它们对用户电脑的侵害,软件分析人员必须分析恶意软件的工作原理。但是,如果这些恶意软件加壳,那么分析它们就会变得非常困难,因此必须对他们进行脱壳。脱壳的第一步即检测这些恶意软件是否加壳。本文通过对未加壳和已经加壳的软件PE头部进行分析与比较,提出了带权欧拉距离PE文件壳检测(PDWED)算法,其中包括构造一个含有10个元素的向量,并为每个向量中每个元素分配一个权重值,计算向量的带权欧拉距离。实验结果表明,PDWED能够比较快速而又准确地检测软件是否加壳。     

恶意软件动态分析云平台

传统的杀毒软件基于特征码识别的方式有效但具有一定的局限性.使用沙箱动态分析的方法能通过目标软件的行为特征对其恶意属性进行判断,可以同时达到检测恶意软件和帮助分析人员快速分析恶意软件的目的.为了提高沙箱平台分析的易用性和高效性,本文设计并实现了一个恶意软件动态分析云平台,通过分布式的沙箱控制机制,保证沙箱的分析能力以及可扩展性,并可通过对目标软件的分析结果来判断其是否属于恶意软件.实验表明,设计的云沙箱系统能够有效和高效的检测出恶意软件的恶意行为.     

基于机器学习的恶意软件检测工具的设计与实现

人工的传统恶意代码检测方法，面对海量恶意样本软件难以满足快速判别大量恶意样本的需求，而基于梯度提升树的机器学习技术给此类需求提供了可能。因此，文章基于Windows系统平台下的逆向工程，利用机器学习算法，通过提取恶意软件的显著特征去训练恶意软件检测模型，并编写恶意软件检测工具实现对恶意软件的检测与分类，有助于减少传统方法人工物力的消耗，快速地批量处理恶意软件样本，能够提高对恶意软件检测的效率与准确率。     

隐藏在注册表中的恶意软件

正病毒名称:Poweliks病毒危害:最近国外的安全公司GData发现了一款比较新型的恶意软件。该恶意软件能够持久地感染目标机器,比较特殊的是该软件不会在目标主机上安装任何文件,而只是在计算机的注册表里面存储它的组件,所以很难通过普通的杀毒软件进行检测。该恶意软件通常是通过邮件的方式进行传播,在     

脱去木马的外衣

木马与杀毒软件之间的战斗从来就没有停止过,通过对已知的木马加壳可以再次躲避杀毒软件的查杀。加了壳的木马可以防止被杀毒软件跟踪查杀和被跟踪调试,同时也可以防止木马本身的算法程序被别人静态分析。加壳软件通常可以分为压缩保护和加密保护两种。     

病毒反抗杀毒软件的主要手段

如今出现了越来越多的对抗杀毒软件以及检测工具扫描的病毒,他们会关闭甚至删除杀毒软件以及检测工具.一般用户很难判断他们藏在哪里,做了些什么.而这时杀毒软件以及安全工具确普遍无法运行.     

基于Siamese架构的恶意软件隐藏函数识别方法北大核心CSCD

目前,隐藏技术已被普遍应用于恶意软件中,以避免反病毒引擎的检测及研究人员的反向分析,所以有效识别恶意软件中的隐藏函数对于恶意软件代码检测和深度分析具有重要意义。但在该领域上,现有方法不同程度都存在一些问题,如无法取得高准确性、对样本量少或者样本类别分布不平衡的数据集的鲁棒性较差等。为实现实用的针对恶意软件隐藏函数的检测方法,文章提出一种新颖的基于Siamese架构的识别方法来检测隐藏函数的类型。该方法可以有效提高隐藏函数识别的准确性,Siamese架构的引入改善了小样本量数据集鲁棒性差的问题。针对从恶意软件中提取的15种常见类型的隐藏函数的数据集进行实验,结果表明,该方法生成的嵌入向量较嵌入神经网络SAFE具有更好的质量,该方法较几种常用的隐藏函数检测工具有更高的检测精度。     

基于Tekton的容器云持续集成和部署平台研究

随着灾害应急云中心业务复杂度的增加和需求的不断变化,快速、持续高质量的实现应用集成和部署成为运维开发的主要目标。为了便于后期的管理,基于微服务架构将现有架构业务功能拆分为多个微服务,针对传统Jenkins方式在Kubernetes容器云平台上部署微服务可能存在的问题,提出了一种基于Tekton的容器云持续集成和部署（Continuous Delivery&Continuous Deployment, CI/CD）方法,研究搭建一个基于Tekton的流水线（Pipeline） CI/CD平台。实践表明,该平台实现代码拉取、编译、镜像构建打包、push镜像、拉取镜像到升级更新部署Kubernetes集群Pod服务自动化流水线管理部署,整个自动化流水线部署流程花费时间约4min左右,实现从新代码提交到交付部署,无需人工干预,大大提升了CI/CD的效率。     

一种基于多特征集成学习的恶意代码静态检测框架

伴随着互联网的普及和5G通信技术的快速发展,网络空间所面临的威胁日益增大,尤其是恶意软件的数量呈指数型上升,其所属家族的变种爆发式增加.传统的基于人工签名的恶意软件的检测方式速度太慢,难以处理每天数百万计新增的恶意软件,而普通的机器学习分类器的误报率和漏检率又明显过高.同时恶意软件的加壳、混淆等对抗技术对该情况造成了更大的困扰.基于此,提出一种基于多特征集成学习的恶意软件静态检测框架.通过提取恶意软件的非PE(Portable Executable)结构特征、可见字符串与汇编码序列特征、PE结构特征以及函数调用关系5部分特征,构建与各部分特征相匹配的模型,采用Bagging集成和Stacking集成算法,提升模型的稳定性,降低过拟合的风险.然后采取权重策略投票算法对5部分集成模型的输出结果做进一步聚合.经过测试,多特征多模型聚合的检测准确率可达96.99%,该结果表明:与其他静态检测方法相比,该方法具有更好的恶意软件鉴别能力,对加壳、混淆等恶意软件同样具备较高的识别率.     

基于One-Hot的CNN恶意代码检测技术

恶意软件的爆炸性增长,以及对用户机和网络环境造成的严重威胁,逐渐成为了网络空间安全领域的主要矛盾。当前传统的基于特征码的静态扫描技术和基于软件行为的恶意软件检测技术容易产生误报和漏报,渐渐无法满足信息安全领域的新要求。为了解决这些问题,提出基于卷积神经网络CNN的恶意代码检测技术。利用Cuckoo沙箱系统来模拟运行环境并提取分析报告;通过编写Python脚本对分析报告进行预处理;搭建深度学习CNN训练模型来实现对恶意代码的检测,并将其与机器学习以及常见的杀毒软件进行比较。实验结果表明,该方法在相比之下更具有优势,并且取得了较好的检测效果,具有更高的可行性。     

System cum Program-Wide Lightweight Malicious Program Execution Detection Scheme for Cloud

ABSTRACT

Cloud is prone to a set of well-known network and host-based attacks from cloud insiders, cloud users, and outside attackers. This paper concretely focuses over the detection of malware and program modification-based attacks through identification of malicious program executions and malware at the client virtual machines and hosts in a cloud environment. The paper also focuses on the related techniques for malware detection using system call sequence measures. An immediate system call structure-based program cum system-wide technique is proposed for the detection of anomalous program executions and malwares in the cloud. The algorithm is validated over University of New Mexico sendmail data set. Effective deployment architecture for such an implementation is also presented as a distributed cum centralized intrusion prevention system (IPS). The proposed IPS also solves the problem of individual IPS getting malformed at client virtual machine with the use of both process and system level based detection strategies. The paper provides detailed results and experimentations of the proposed intrusion detection technique on a private cloud with open nebula and virtual box.     

A similarity metric method of obfuscated malware using function-call graph

Code obfuscating technique plays a significant role to produce new obfuscated malicious programs, generally called malware variants, from previously encountered malwares. However, the traditional signature-based malware detecting method is hard to recognize the up-to-the-minute obfuscated malwares. This paper proposes a method to identify the malware variants based on the function-call graph. Firstly, the function-call graphs were created from the disassembled codes of program; then the caller–callee relationships of functions and the operational code (opcode) information about functions, combining the graph coloring techniques were used to measure the similarity metric between two function-call graphs; at last, the similarity metric was utilized to identify the malware variants from known malwares. The experimental results show that the proposed method is able to identify the obfuscated malicious softwares effectively.     

Novel active learning methods for enhanced PC malware detection in windows OS

The formation of new malwares every day poses a significant challenge to anti-virus vendors since antivirus tools, using manually crafted signatures, are only capable of identifying known malware instances and their relatively similar variants. To identify new and unknown malwares for updating their anti-virus signature repository, anti-virus vendors must daily collect new, suspicious files that need to be analyzed manually by information security experts who then label them as malware or benign. Analyzing suspected files is a time-consuming task and it is impossible to manually analyze all of them. Consequently, anti-virus vendors use machine learning algorithms and heuristics in order to reduce the number of suspect files that must be inspected manually. These techniques, however, lack an essential element – they cannot be daily updated. In this work we introduce a solution for this updatability gap. We present an active learning (AL) framework and introduce two new AL methods that will assist anti-virus vendors to focus their analytical efforts by acquiring those files that are most probably malicious. Those new AL methods are designed and oriented towards new malware acquisition. To test the capability of our methods for acquiring new malwares from a stream of unknown files, we conducted a series of experiments over a ten-day period. A comparison of our methods to existing high performance AL methods and to random selection, which is the naïve method, indicates that the AL methods outperformed random selection for all performance measures. Our AL methods outperformed existing AL method in two respects, both related to the number of new malwares acquired daily, the core measure in this study. First, our best performing AL method, termed “Exploitation”, acquired on the 9th day of the experiment about 2.6 times more malwares than the existing AL method and 7.8 more times than the random selection. Secondly, while the existing AL method showed a decrease in the number of new malwares acquired over 10 days, our AL methods showed an increase and a daily improvement in the number of new malwares acquired. Both results point towards increased efficiency that can possibly assist anti-virus vendors.     

A graph mining approach for detecting unknown malwares

Nowadays malware is one of the serious problems in the modern societies. Although the signature based malicious code detection is the standard technique in all commercial antivirus softwares, it can only achieve detection once the virus has already caused damage and it is registered. Therefore, it fails to detect new malwares (unknown malwares). Since most of malwares have similar behavior, a behavior based method can detect unknown malwares. The behavior of a program can be represented by a set of called API's (application programming interface). Therefore, a classifier can be employed to construct a learning model with a set of programs' API calls. Finally, an intelligent malware detection system is developed to detect unknown malwares automatically. On the other hand, we have an appealing representation model to visualize the executable files structure which is control flow graph (CFG). This model represents another semantic aspect of programs. This paper presents a robust semantic based method to detect unknown malwares based on combination of a visualize model (CFG) and called API's. The main contribution of this paper is extracting CFG from programs and combining it with extracted API calls to have more information about executable files. This new representation model is called API-CFG. In addition, to have fast learning and classification process, the control flow graphs are converted to a set of feature vectors by a nice trick. Our approach is capable of classifying unseen benign and malicious code with high accuracy. The results show a statistically significant improvement over n-grams based detection method.     

基于数据特征的内核恶意软件检测

内核恶意软件对操作系统的安全造成了严重威胁.现有的内核恶意软件检测方法主要从代码角度出发,无法检测代码复用、代码混淆攻击,且少量检测数据篡改攻击的方法因不变量特征有限导致检测能力受限.针对这些问题,提出了一种基于数据特征的内核恶意软件检测方法,通过分析内核运行过程中内核数据对象的访问过程,构建了内核数据对象访问模型;然后,基于该模型讨论了构建数据特征的过程,采用动态监控和静态分析相结合的方法识别内核数据对象,利用EPT监控内存访问操作构建数据特征;最后讨论了基于数据特征的内核恶意软件检测算法.在此基础上,实现了内核恶意软件检测原型系统MDS-DCB,并通过实验评测MDS-DCB的有效性和性能.实验结果表明：MDS-DCB能够有效检测内核恶意软件,且性能开销在可接受的范围内.     

基于免疫原理的恶意软件检测模型*

针对恶意软件检测尤其是未知恶意软件检测的不足,提出一种基于免疫原理的恶意软件检测模型,该模型采用程序运行时产生的IRP请求序列作为抗原,定义系统中的正常程序为自体,恶意程序为非自体,通过选定数量的抗体,采用人工免疫原理对非自体进行识别。实验结果表明,此模型在恶意软件的检测方面具有较高的准确率,且误报和漏报率较低,是一种有效的恶意软件检测方法。     

Trends of anti-analysis operations of malwares observed in API call logs

Some malwares execute operations that determine whether they are running in an analysis environment created by monitoring software, such as debuggers, sandboxing systems, or virtual machine monitors, and if such an operation finds that the malware is running in an analysis environment, it terminates execution to prevent analysis. The existence of malwares that execute such operations (anti-analysis operations) is widely known. However, the knowledge acquired thus far, regarding what proportion of current malwares execute anti-analysis operations, what types of anti-analysis operations they execute, and how effectively such operations prevent analysis, is insufficient. In this study, we analyze FFRI Dataset, which is a dataset of dynamic malware analysis results, and clarify the trends in the anti-analysis operations executed by malware samples collected in 2016. Our findings revealed that, among 8243 malware samples, 856 (10.4%) samples executed at least one type of the 28 anti-analysis operations investigated in this study. We also found that, among the virtual machine monitors, VMware was the most commonly searched for by the malware samples.     

基于感知哈希算法和特征融合的恶意代码检测方法

在当前的恶意代码家族检测中,通过恶意代码灰度图像提取的局部特征或全局特征无法全面描述恶意代码,针对这个问题并为提高检测效率,提出了一种基于感知哈希算法和特征融合的恶意代码检测方法。首先,通过感知哈希算法对恶意代码灰度图样本进行检测,快速划分出具体恶意代码家族和不确定恶意代码家族的样本,实验测试表明约有67%的恶意代码能够通过感知哈希算法检测出来。然后,对于不确定恶意代码家族样本再进一步提取局部特征局部二值模式（LBP）与全局特征Gist,并利用二者融合后的特征通过机器学习算法对恶意代码样本进行分类检测。最后,对于25类恶意代码家族检测的实验结果表明,相较于仅用单一特征,使用LBP与Gist的融合特征时的检测准确率更高,并且所提方法与仅采用机器学习的检测算法相比分类检测效率更高,检测速度提高了93.5%。