2012 IEEE/IPSJ 12 th International Symposium on Applications and the Internet 陳盈妤 1/10

Outline  Introduction of proposed method  Previous works by catching random behavior  Procedure of proposed method  Results  Conclusion 2/10

Introduction of proposed method  Random Behavior - change filename - random domain name  Static Software Analysis vs. Dynamic Software Analysis  Packing and code obfuscation 3/10

Previous works by catching random behavior  Balzarotti – difference of emulated analysis environment and reference host  Kolbitsch – compare if malware’s essential information flow match suspect program  Sakai – repetitive behavior in propagation  Matsuki – execute decoy processes to find malwares which will kill process of anti-virus software and firewall 4/10

Start Sample, i = Number of Executions i = i -1 Compare the lists Conduct dynamic analysis on the sample i > 0 Generate lists of parameters from each execution Benign Malicious End Yes No Exactly match or Inclusion relation Difference 5/10

Procedure of proposed method  5697 malware samples, 819 benign samples.  Execute each sample for 60 seconds and collect the API call log  Isolated from the real Internet  In this experiment, each sample will only be executed twice.  Symantec and McAfee 6/10

Procedure of proposed method API RegSetValueEx RegSetValue CreateFile LZOpenFile _lcreat CopyFile Lzcopy MoveFile DNSQuery HttpOpenRequest InternetConnect HKEY_LOCAL_MACHINE\Software\M icrosoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\S\M\Window s\CurrentVersion\Run 7/10

Result True PositiveFalse NegativeTP Rate All Registry File Network False PositiveTrue NegativeFP Rate All Registry File Network It could detect 117 malware samples out of 273 malware samples which could not be detected by the antivirus software(Symantec and McAfee) 8/10

Conclusion  Advantage ： won’t be disturbed by packing and code obfuscation techniques  Disadvantage ： Slow, sandbox may be detected  The proposed method may be able to improve the accuracy of malware detection utilizing in combination with other existing methods 9/10

Thanks for listening 10/10