• Journal of Convergence for Information Technology
• /
• v.11 no.6
• /
• pp.24-32
• /
• 2021

Recently, ransomware attacks have been infected through various channels such as e-mail, phishing, and device hacking, and the extent of the damage is increasing rapidly. However, existing known malware (static/dynamic) analysis engines are very difficult to detect/block against novel ransomware that has evolved like Advanced Persistent Threat (APT) attacks. This work proposes a method for modeling ransomware malicious behavior based on graph databases and detecting novel multi-complex malicious behavior for ransomware. Studies confirm that pattern detection of ransomware is possible in novel graph database environments that differ from existing relational databases. Furthermore, we prove that the associative analysis technique of graph theory is significantly efficient for ransomware analysis performance.

• Annual Conference of KIPS
• /
• 2024.10a
• /
• pp.320-323
• /
• 2024

악성코드에 의한 공격은 연평균 수억 건 이상 발생하고 있으며, 큰 폭으로 증가하는 악성코드 개수에 비해 악성코드 분석가가 각 악성코드를 분석하고 대응하기에는 한계가 있다. 이와 같은 한계를 극복하기 위한 방법으로 악성코드 자동 분석 시스템을 사용하는 방법이 있다. 그러나 악성코드에 Anti-VM 기술들이 포함된 경우 자동 분석 시스템에서는 제대로 탐지하기 어렵다는 단점이 있다. 본 논문에서 Anti-VM 기술에 활용되는 API 와 API 의 파라미터 정보를 분석하여 API 후킹 모듈을 기반으로 Anti-VM 탐지 우회 방법을 제안한다. Anti-VM 기술은 Virtual Box 기반의 가상 환경을 탐지하는 기술을 기준으로 연구를 진행하였고 API 및 파라미터 또한 Virtual Box 기반의 가상 환경을 탐지할 때 활용되는 API 및 파라미터를 분석하였다. 분석한 데이터를 기반으로 Anti-VM 기술을 우회하기 위한 API 및 후킹 프로그램을 제작해서 연구를 진행하였다. 연구 결과 Virtual Box 기반의 가상 환경을 탐지하는 기술 중 시간 딜레이, 마우스 이벤트 등의 행위 기반 탐지 기술은 명확한 지표를 측정하기 어려워 우회가 어려웠으나 가상 환경 특성 탐지, 파일 아티팩트 탐지, 레지스트리 및 시스템 설정 탐지 기술은 식별 및 우회에 뛰어난 성능을 보였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.2
• /
• pp.37-47
• /
• 2011

In the recent years, malicious codes called malware are having shown significant increase due to the code obfuscation to evade detection mechanisms. When the code obfuscation technique is applied to malwares, they can change their instruction sequence and also even their signature. These malwares which have same functionality and different appearance are able to evade signature-based AV products. Thus, AV venders paid large amount of cost to analyze and classify malware for generating the new signature. In this paper, we propose a novel approach for detecting metamorphic malwares. The proposed mechanism first converts malware's API call sequences to call graph through dynamic analysis. After that, the callgraph is converted to semantic signature using 128 abstract nodes. Finally, we extract all subgraphs and analyze how similar two malware's behaviors are through subgraph similarity. To validate proposed mechanism, we use 273 real-world malwares include obfuscated malware and analyze 10,100 comparison results. In the evaluation, all metamorphic malwares are classified correctly, and similar module behaviors among different malwares are also discovered.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.1
• /
• pp.105-115
• /
• 2019

Recently, intelligent Android malicious codes have become difficult to detect malicious behavior by static analysis alone. Malicious code with SO file, dynamic loading, and string obfuscation are difficult to extract information about original code even with various tools for static analysis. There are many dynamic analysis methods to solve this problem, but dynamic analysis requires rooting or emulator environment. However, in the case of dynamic analysis, malicious code performs the rooting and the emulator detection to bypass the analysis environment. To solve this problem, this paper investigates a variety of root detection schemes and builds an environment for bypassing the rooting detection in real devices. In addition, SDK code hooking module for Android malicious code analysis is designed using Xposed, and intent tracking for code flow, dynamic loading file information, and various API information extraction are implemented. This work will contribute to the analysis of obfuscated information and behavior of Android Malware.

• Journal of Convergence for Information Technology
• /
• v.12 no.4
• /
• pp.126-132
• /
• 2022

At present, due to the rapid spread of smartphones and activation of IoT, malicious codes are disseminated using SNS, or intelligent intrusions such as intelligent APT and ransomware are in progress. The damage caused by the intelligent intrusion is also becoming more consequential, threatening, and emergent than the previous intrusion. Therefore, in this paper, we propose an intelligent intrusion situation-aware reasoning system to detect transgression behavior made by such intelligent malicious code. The proposed system was used to detect and respond to various intelligent intrusions at an early stage. The anticipated system is composed of an event monitor, event manager, situation manager, response manager, and database, and through close interaction between each component, it identifies the previously recognized intrusive behavior and learns about the new invasive activities. It was detected through the function to improve the performance of the inference device. In addition, it was found that the proposed system detects and responds to intelligent intrusions through the state of detecting ransomware, which is an intelligent intrusion type.

• Convergence Security Journal
• /
• v.15 no.1
• /
• pp.3-9
• /
• 2015

In this paper, a detection technique of smishing using a TaintDroid is suggested. Suggesting system detects malicious acts by transmitting a URL to the TaintDroid server and installing a relevant application to a virtual device of the TaintDroid server, when a smartphone user receives a text message including the URL suspected as a smishing. Through this we want to distinguish an application that can not install because of suspicion of a smishing in an actual smartphone whether said application is malicious application or not by testing with the virtual device of said system. The detection technique of a smishing using the TaintDroid suggested in this paper is possible to detect in a new form a smishing with a text message and to identifying which application it is through analysis of results from a user.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06c
• /
• pp.280-282
• /
• 2012

스마트폰 사용자가 증가함에 따라 스마트폰 사용자를 노리는 악성코드 또한 증가하고 있다. 국내의 다양한 스마트폰 운영체제 중 특히 안드로이드의 경우 오픈소스 정책 및 다양한 기기의 보급을 통해 사용자가 증가함에 따라 악성코드 또한 증가하고 있다. 현재 대부분의 악성코드 탐지 프로그램의 경우 위변조 혹은 새로운 악성코드에 대응이 어렵다는 문제점이 존재한다. 이에 본 논문에서는 행위기반 탐지 및 머신러닝 기법 적용을 통한 악성코드 탐지 방법을 제시하고자 한다.

• Annual Conference of KIPS
• /
• 2013.11a
• /
• pp.771-773
• /
• 2013

모바일 단말은 다양한 서비스와 컨텐츠를 지원하지만, 최근 모바일 악성코드의 급증으로 인하여 사용자에게 개인 정보 유출, 요금 과다 등의 피해를 초래하고 있다. 특히, 안드로이드 플랫폼은 오픈 플랫폼으로서 공격자들이 악성코드를 배포하기에 유리한 환경을 가지고 있어 시그니처/행위기반 분석방법을 통한 악성코드 탐지 연구가 활발히 진행되고 있다. 본 논문에서는 안드로이드 플랫폼에서 악성코드를 탐지하기 위한 Feature를 선정하였다. 또한 SVM(Support Vector Machine) 기계학습 알고리즘을 통하여 악성코드 탐지성능을 분석하고 우수성을 검증하였다.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.20 no.7
• /
• pp.613-621
• /
• 2019

Recently, with the development of the Internet of Things (IoT) and cloud computing technologies, security threats have increased as malicious codes infect IoT devices, and new malware spreads ransomware to cloud servers. In this study, we propose a threat-detection technique that checks obfuscated script patterns to compensate for the shortcomings of conventional signature-based and behavior-based detection methods. Proposed is a malicious code-detection technique that is based on malicious script-pattern analysis that can detect zero-day attacks while maintaining the existing detection rate by registering and checking derived distribution patterns after analyzing the types of malicious scripts distributed through websites. To verify the performance of the proposed technique, a prototype system was developed to collect a total of 390 malicious websites and experiment with 10 major malicious script-distribution patterns derived from analysis. The technique showed an average detection rate of about 86% of all items, while maintaining the existing detection speed based on the detection rule and also detecting zero-day attacks.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06c
• /
• pp.221-223
• /
• 2012

안드로이드 모바일 플랫폼 환경에서 정보유출, 과금유발 그리고 피싱과 같은 행위를 하는 대부분의 악성코드는 안드로이드 환경에서 기본적으로 제공되는 API(Application Programming Interface)를 이용한 것으로, 이러한 악성코드 탐지 방법으로는 정적 분석과 동적 분석 방법이 있다. 현재까지 두 가지 분석 방법에 대한 연구가 활발히 진행되고 있으며 두 가지 방식을 혼합한 형태의 검증 프로세스가 제안되고 있다. 그러나 본 논문에서 다루어지는 Radio Interface Layer 에서의 악성행위는 안드로이드 모바일 기기의 통신칩에 직접적으로 명령을 입력하는 방식으로, 그동안 악성코드 형태로 발견된 사례가 없으며, 이로 인해 발생 가능한 피해가 크므로 관련 내용을 살펴보고 대응 방안을 제시하고자 한다.