基于内核对象的动态恶意代码检测

发布时间：2018-02-01 23:42

本文关键词： 内核对象动态污点分析公共行为图恶意代码检测　出处：《哈尔滨工业大学》2014年硕士论文　论文类型：学位论文

【摘要】：随着互联网的发展,越来越多的恶意代码产生并攻击人们的计算机系统,影响了人们的正常生活。尽管现在已经存在一些恶意代码检测技术,但是随着恶意代码种类的增加以及传播速度的提升,这些技术的检测能力以及抗攻击力越来越不能满足人们的需求,因此需要提出具有更高效率以及检测效果的恶意代码检测技术。目前主要有动态以及静态恶意代码检测技术这两种类型的检测方法。然而静态恶意代码检测技术会受加壳、混淆等反分析技术影响,而动态的检测技术直接运行样本并捕获样本运行时的行为,不会受这些反分析技术的影响。内核对象是内核中的一个内存块,具体地说,其是一个数据结构,并且在其中保存着和对象相关的信息。而大多数恶意样本的主要恶意行为都是通过操控内核对象实现的,所以将内核对象引入恶意代码检测具有很大的意义。而现在的很多基于图的检测方法中使用的都是系统调用行为图,不仅会引入一些与恶意行为无关的噪音而且对混淆技术的抵抗力较弱。本文实现了一种基于内核对象的动态恶意代码检测技术。具体实现过程如下所述:本文使用动态污点分析技术监控样本在运行时污点在各个内核对象之间的传播路径,并捕获内核对象之间的依赖关系以及各个内核对象的对象属性等信息,将这些信息存入结果文件。解析结果文件并在此基础上构建内核对象行为图,之后使用图聚类方法为每个恶意家族构建一个公共行为图,并使用图的匹配得到相应的检测结果。本文方法具有较高检测率以及较低误报率等特点,其检测效果相比一些基于系统调用依赖图的方法具有一定的提高。并且本文在二进制分析平台Bitblaze的动态二进制分析组件TEMU基础上编写插件实现了动态污点分析功能,捕获了污点在内核对象之间的传播路径进而获得了内核对象之间的依赖关系。
[Abstract]:With the development of the Internet, more and more malicious code has been generated and attacked people's computer system, which has affected people's normal life, although there are some malicious code detection techniques. However, with the increase of malicious code types and the speed of transmission, the detection ability and anti-attack ability of these technologies are more and more unable to meet the needs of people. Therefore, it is necessary to put forward malicious code detection technology with higher efficiency and detection effect. At present, there are two kinds of detection methods: dynamic and static malicious code detection technology. However, static malicious code detection technology. It's going to be hulled. Obfuscation and other back-analysis techniques, while dynamic detection techniques directly run samples and capture the behavior of the sample runtime, will not be affected by these back-analysis techniques. Kernel objects are a block of memory in the kernel. Specifically, it is a data structure in which object-related information is stored. The main malicious behavior of most malicious samples is achieved by manipulating kernel objects. So it is very important to introduce kernel object into malicious code detection. Now many graph-based detection methods use system call behavior graph. Not only will some noise independent of malicious behavior be introduced, but also the resistance to obfuscation technology is weak. This paper implements a dynamic malicious code detection technology based on kernel object. The implementation process is as follows:. In this paper, the dynamic stain analysis technique is used to monitor the propagation path of the samples at run time between each kernel object. The dependency between kernel objects and the object properties of each kernel object are captured and stored in the result file. The result file is parsed and the behavior graph of kernel object is constructed on this basis. Then we use graph clustering method to construct a common behavior graph for each malicious family and use graph matching to get the corresponding detection results. This method has the characteristics of high detection rate and low false alarm rate. Compared with some methods based on system call dependency graph, the detection effect is improved in this paper. Furthermore, the plug-in is written on the basis of dynamic binary analysis component TEMU of binary analysis platform Bitblaze. The function of dynamic stain analysis is realized. The propagation path of stain between kernel objects is captured and the dependencies between kernel objects are obtained.
【学位授予单位】：哈尔滨工业大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】