论文标题
基于恶意软件变体检测的基于opcode图生成
Clustering based opcode graph generation for malware variant detection
论文作者
论文摘要
Malwares是威胁参与者在网络空间中杠杆作用的关键手段。市场上有各种各样的商业解决方案和大量的科学研究，以应对针对马尔沃雷斯的检测和防御的挑战。同时，攻击者还提高了他们在创建多态和变质型恶质方面的能力，以使其对现有解决方案的挑战越来越大。为了解决这个问题，我们提出了一种执行恶意软件检测和家庭归因的方法。所提出的方法首先执行从每个家族中的麦芽糖中提取opcodes，并构建其各自的OpCode图。我们探索在OpCode图上使用聚类算法的使用来检测同一恶意软件家族中Malwares的簇。这样的集群可以看作是属于不同的子家庭组。 OpCode图签名是从每个检测到的群集中构建的。因此，对于每个恶意软件家族，都会产生一组签名来代表家庭。这些签名用于将未知样本分类为良性或属于恶意软件家族的样本。我们通过在数据集上进行实验来评估我们的方法论，该数据集由良性文件和属于许多不同恶意软件系列的恶意软件样本组成，并将结果与现有方法进行比较。
Malwares are the key means leveraged by threat actors in the cyber space for their attacks. There is a large array of commercial solutions in the market and significant scientific research to tackle the challenge of the detection and defense against malwares. At the same time, attackers also advance their capabilities in creating polymorphic and metamorphic malwares to make it increasingly challenging for existing solutions. To tackle this issue, we propose a methodology to perform malware detection and family attribution. The proposed methodology first performs the extraction of opcodes from malwares in each family and constructs their respective opcode graphs. We explore the use of clustering algorithms on the opcode graphs to detect clusters of malwares within the same malware family. Such clusters can be seen as belonging to different sub-family groups. Opcode graph signatures are built from each detected cluster. Hence, for each malware family, a group of signatures is generated to represent the family. These signatures are used to classify an unknown sample as benign or belonging to one the malware families. We evaluate our methodology by performing experiments on a dataset consisting of both benign files and malware samples belonging to a number of different malware families and comparing the results to existing approach.
