基于基因视角的恶意代码同源性判定

赵炳麟; 单征; 刘福东; 赵博; 陈奕杭; 孙文杰

doi:10.1631/FITEE.1800523

Your Location：

Home >

Browse articles >

基于基因视角的恶意代码同源性判定

常规文章 | Updated：2022-05-19

- 基于基因视角的恶意代码同源性判定
- Malware homology identification based on a gene perspective
- 信息与电子工程前沿（英文） 2019年20卷第6期页码：801-815
- Affiliations：
  
  State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China
  Georg-August-University of Goettingen, Goettingen 37077, Germany
- Author bio：
  
  [ "Bing-lin ZHAO, E-mail: gzu_zhaobl@126.com" ]
  Zheng SHAN, E-mail: zzzhengming@163.com
  [ "Fu-dong LIU, E-mail:lwfydy@126.com" ]
- Funds：
  
  Project supported by the National Natural Science Foundation of China (Nos. 61472447 and 61802435)
- DOI：10.1631/FITEE.1800523
  中图分类号： TP309.5
- 收稿：2018-08-31，
  
  修回：2019-;6-11，
  
  纸质出版：2019-06
- Accepted：
Scan QR Code
赵炳麟, 单征, 刘福东, 等. 基于基因视角的恶意代码同源性判定[J]. 信息与电子工程前沿（英文）, 2019,20(6):801-815.

Bing-lin ZHAO, Zheng SHAN, Fu-dong LIU, et al. Malware homology identification based on a gene perspective[J]. Frontiers of Information Technology & Electronic Engineering, 2019, 20(6): 801-815.
赵炳麟, 单征, 刘福东, 等. 基于基因视角的恶意代码同源性判定[J]. 信息与电子工程前沿（英文）, 2019,20(6):801-815. DOI： 10.1631/FITEE.1800523.

Bing-lin ZHAO, Zheng SHAN, Fu-dong LIU, et al. Malware homology identification based on a gene perspective[J]. Frontiers of Information Technology & Electronic Engineering, 2019, 20(6): 801-815. DOI： 10.1631/FITEE.1800523.

摘要

恶意代码同源性判定对攻击事件溯源、应急响应方案处置以及事件发展趋势预测有重要作用。目前，恶意代码同源性判定以人工分析为主，效率较低，对安全事件的爆发无法快速响应。因此，提出一种新的从基因视角分析的恶意代码同源性判定方法。恶意代码基因由表示家族同源性的子图组成。通过筛选关键应用程序接口和利用社团划分算法，从函数依赖图中提取关键子图作为恶意代码基因。然后，设计一种频繁子图挖掘算法发现恶意代码家族的共有基因，并对基因编码。最后，利用家族共有基因指导恶意代码同源性判定。对公开数据集的分类和实验结果表明，分类准确率达97%，且效率较高。

Abstract

Malware homology identification is important in attacking event tracing

emergency response scheme generation

and event trend prediction. Current malware homology identification methods still rely on manual analysis

which is inefficient and cannot respond quickly to the outbreak of attack events. In response to these problems

we propose a new malware homology identification method from a gene perspective. A malware gene is represented by the subgraph

which can describe the homology of malware families. We extract the key subgraph from the function dependency graph as the malware gene by selecting the key application programming interface (API) and using the community partition algorithm. Then

we encode the gene and design a frequent subgraph mining algorithm to find the common genes between malware families. Finally

we use the family genes to guide the identification of malware based on homology. We evaluate our method with a public dataset

and the experiment results show that the accuracy of malware classification reaches 97% with high efficiency.

关键词

Keywords

references

S Alam , , , RN Horspool , , , I Traore . . MAIL: Malware Analysis Intermediate Language: a step towards automating and optimizing malware detection . . Proc 6 th Int Conf on Security of Information and Networks , , 2013 . . p.233 - - 240 . . DOI: 10.1145/2523514.2527006 http://doi.org/10.1145/2523514.2527006 . .

S Alam , , , RN Horspool , , , I Traore . . MARD: a framework for metamorphic malware analysis and real-time detection . . 28 th Int Conf on Advanced Information Networking and Applications , , 2014 . . p.212 - - 233 . . DOI: 10.1109/AINA.2014.59 http://doi.org/10.1109/AINA.2014.59 . .

S Cesare , , , Y Xiang , , , WL Zhou . . Malwise—an effective and efficient classification system for packed and polymorphic malware . . IEEE Trans Comput , , 2013 . . 62 ( ( 6 ): ): 1193 - - 1206 . . DOI: 10.1109/TC.2012.65 http://doi.org/10.1109/TC.2012.65 . .

M Defferrard , , , X Bresson , , , P Vandergheynst . . Convolutional neural networks on graphs with fast localized spectral filtering . . Conf and Workshop on Neural Information Processing Systems , , 2016 . . p.3837 - - 3845 . . . .

J Drew , , , T Moore , , , M Hahsler . . Polymorphic malware detection using sequence classification methods . . Security and Privacy Workshops , , 2016 . . p.81 - - 87 . . DOI: 10.1109/SPW.2016.30 http://doi.org/10.1109/SPW.2016.30 . .

J Han , , , RC Zhao , , , Z Shan , , , 等 . . Analyzing and recognizing Android malware via semantic-based malware gene . . Int Conf on Cyber-Enabled Distributed Computing and Knowledge Discovery , , 2018 . . p.17 - - 20 . . DOI: 10.1109/CyberC.2017.36 http://doi.org/10.1109/CyberC.2017.36 . .

JW Jang , , , J Woo , , , J Yun , , , 等 . . Mal-netminer: malware classification based on social network analysis of call graph . . Proc 23 rd Int Conf on World Wide Web , , 2014 . . p.731 - - 734 . . DOI: 10.1145/2567948.2579364 http://doi.org/10.1145/2567948.2579364 . .

Kaggle . . Microsoft Malware Classification Challenge (Big 2015) . . 2015 . . https://www.kaggle.com/c/malware-classification https://www.kaggle.com/c/malware-classification , , [Accessed on Nov. 4, 2015] . .

J Kinable , , , O Kostakis . . Malware classification based on call graph clustering . . J Comput Virol , , 2011 . . 7 ( ( 4 ): ): 233 - - 245 . . DOI: 10.1007/s11416-011-0151-y http://doi.org/10.1007/s11416-011-0151-y . .

TN Kipf , , , M Welling . . Semi-supervised classification with graph convolutional networks . . 2016 . . https://arxiv.org/abs/1609.02907?context=cs https://arxiv.org/abs/1609.02907?context=cs , , . .

D Kirat , , , G Vigna . . MalGene: automatic extraction of malware analysis evasion signature . . Proc 22 nd ACM SIGSAC Conf on Computer and Communications Security , , 2015 . . p.769 - - 780 . . DOI: 10.1145/2810103.2813642 http://doi.org/10.1145/2810103.2813642 . .

L Liu , , , BS Wang , , , B Yu , , , 等 . . Automatic malware classification and new malware detection using machine learning . . Front Inform Technol Electron Eng , , 2017 . . 18 ( ( 9 ): ): 1336 - - 1347 . . DOI: 10.1631/FITEE.1601325 http://doi.org/10.1631/FITEE.1601325 . .

S Naval , , , V Laxmi , , , M Rajarajan , , , 等 . . Employing program semantics for malware detection . . IEEE Trans Inform Forens Secur , , 2017 . . 10 ( ( 12 ): ): 2591 - - 2604 . . DOI: 10.1109/TIFS.2015.2469253 http://doi.org/10.1109/TIFS.2015.2469253 . .

YC Qiao , , , XC Yun , , , YZ Zhang , , , 等 . . An automatic malware homology identification method based on calling habits . . Acta Electron Sin , , 2016 . . 44 ( ( 10 ): ): 2410 - - 2414 . . DOI: 10.3969/j.issn.0372-2112.2016.10.019 http://doi.org/10.3969/j.issn.0372-2112.2016.10.019 . .

Qihoo 360 . . Ransomware Threat Situation Analysis Report . . 2017 . . http://zt.360.cn/1101061855.php?dtid=1101062360&did=490927082 http://zt.360.cn/1101061855.php?dtid=1101062360&did=490927082 , , . .

XZ Wang , , , JW Liu , , , XE Chen . . Microsoft Malware Classification Challenge (Big 2015) first place team: say no to overfitting . . 2015 . . https://github.com/xiaozhouwang/kaggle_Microsoft_Malware/blob/master/Saynotooverfitting.pdf https://github.com/xiaozhouwang/kaggle_Microsoft_Malware/blob/master/Saynotooverfitting.pdf , , [Accessed on Nov. 2, 2015] . .

J Wu , , , MX Dong , , , K Ota , , , 等 . . Big data analysis-based secure cluster management for optimized control plane in software-defined networks . . IEEE Trans Network Ser Manag , , 2018a . . 15 ( ( 1 ): ): 27 - - 38 . . DOI: 10.1109/TNSM.2018.2799000 http://doi.org/10.1109/TNSM.2018.2799000 . .

J Wu , , , SB Luo , , , S Wang , , , 等 . . NLES: a novel lifetime extension scheme for safety-critical cyber-physical systems using SDN and NFV . . IEEE Int Things J , , 2018b . . 6 ( ( 2 ): ): 2463 - - 2475 . . DOI: 10.1109/JIOT.2018.2870294 http://doi.org/10.1109/JIOT.2018.2870294 . .

B Yu , , , Y Fang , , , Q Yang , , , 等 . . A survey of malware behavior description and analysis . . Front Inform Technol Electron Eng , , 2018 . . 19 ( ( 5 ): ): 583 - - 603 . . DOI: 10.1631/FITEE.1601745 http://doi.org/10.1631/FITEE.1601745 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Automatic malware classification and new malware detection using machine learning