自動化惡意程式貼標系統

近年來，惡意程式產製的速度快速地成長，對個人、企業造成的威脅也日漸增加，倘若了解各惡意程式執行過程中透過哪些攻擊手法達到其惡意目的，將直接對惡意程式偵測、防禦及後續惡意程式分析有相當大的幫助。儘管各防毒廠商試圖透過標籤(label)向資訊安全專家、一般使用者表達惡意程式所屬的種類(type)、平台(platform)、家族(family)或變種版本[5]，進而讓使用者們對此惡意程式造成的影響、威脅有個初步的概念。然而過去文獻[3]指出每一家防毒廠商有各自標籤的準則與依據，其中多所不一致。且根據[11]，儘管屬於同一個標籤的惡意程式，其行為態樣仍相當多元，這就說明了目前提出的標籤不具有語意解釋力。所以本篇論文提出檢視個別惡意程式的執行序(a sequence of API call invocations)，並由執行序中萃取出一系列階段性執行活動(activity group)。在萃取出activity group後，我們參考MITRE ATT&CK框架下的攻擊手法，給予每一個階段性執行活動語意描述標籤，最終得到一系列語意描述標籤序。一系列語意描述標籤序能夠清楚呈現各階段執行活動的執行意圖及惡意程式的目的，藉此提供深度且清楚的惡意程式家族的惡意活動說明。

關鍵字

惡意程式；語意描述標籤；惡意意圖；惡意行為；動態分析

並列摘要

In recent years, the speed of malware production has grown rapidly, and the threat to individuals and businesses has increased. If we understand the attack techniques used by malware to achieve their malicious purposes, we can directly detect and defend against malware. Although anti-virus vendors try to explain the impact and threat of malware to the security experts by labels. However, [3] pointed out that each Anti-Virus vendor has its own labeling criteria and basis, and many of them are inconsistent. According to [11], although the malware belonging to the same label, their behavior are still quite diverse. It indicates that the currently proposed label does not have a semantic explanatory power. Therefore, this thesis proposes to examine a sequence of API call invocations, and extracts a sequence of activity groups from the execution sequence. After extracting the activity groups, we refer to the attack technique under the MITRE ATT&CK framework, and give each activity group one semantic description tag, and finally get a sequence of semantic description tag. A sequence of semantic description tags can clearly show the execution intent of each stage of execution activities and the purpose of the malware, thereby providing a deep and clear description of the malicious activity of the malware family.

並列關鍵字

Malware ； Semantic description tag ； Malicious Intent ； Malicious Behavior ； Dynamic Analysis

參考文獻

[1] (2018). McAfee Labs Threats Report. [Online]. Available: https://www.mcafee.com/enterprise/en-us/assets/reports/rp-quarterly-threats-sep-2018.pdf (線上資源範本)