行為分析之惡意程式偵測

Detecting Malicious Software By Monitoring Program Behavior

邱銘彰(Jeremy Chiu)

指導教授 ： 林金城

大同大學/電機資訊學院/資訊工程學系所/碩士(2004年)

摘要

入侵偵測指的是偵測不適當、不正確或是異常的活動的技術。入侵偵測系統實際上就是完成這些偵測不適當、不正確或是異常的活動的系統。當然，在資訊安全領域中，這些不適當、不正確或是異常的活動指的是和資訊安全相關的各式活動。

本文的研究是以Hose-based IDS為主。HIDS是以主機上的資料作為偵測用的依據，所以，HIDS可以取得像是Server的Log或是使用者的使用記錄，甚至是Process的一些行為等。因此，所獲得的資料相對於Network-based IDS更顯的高階，分析來的結果會越接近Intruder的意圖。本文的研究主題便是以Process Behavior做為分析對象，透過intercept system call的技術，可以採集到許多的行為特徵，進而發展出一些Program behavior modeling的演算法

關鍵字

入侵偵測 ； 惡意程式 ； 行為分析

並列摘要

We present a host-based intrusion detection system (IDS) for Microsoft Windows. The system is an algorithm that detects malicious program on the host machine by monitoring Windows API-Calls. The idea is to train a behavior model of malicious programs, and use this model to detect malicious programs at run-time. Once there models have been established, subsequent API-Log are analyzed to identify deviations, given the assumption that anomalies usually represent evidence of an attack.

並列關鍵字

anomaly models ； API-Hook ； Intrusion detection ； system calls

參考文獻

 [Allen99] Allen, Julia, et al. State of the Practice of Intrusion Detection Technologies. (CMU/SEI-99/TR-028). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 1999.

 [Chin03] R. Chinchani, S. Upadhyaya & K. Kwiat. A Tamper-Resistant Framework for Unambiguous Detection of Attacks in User Space Using Process Monitors. IEEE International Workshop on Information Assurance, Darmstadt, Germany, March 2003.

 [Feng03] H. Feng, O. Kolesnikov, P. Fogla, W. Lee & W. Gong, Anomaly Detection Using Call Stack Information, IEEE S&P, 2003.

 [Forr98] S. Forrest, S. A. Hofmeyr, A. Intrusion Detection using Sequences of System Calls, Somayaji, in Journal of Computer Security, vol. 6, pp 151-180, 1998.

 [Sekar01] R. Sekar , M. Bendre , D. Dhurjati , P. Bollineni, A Fast Automaton-Based Method for Detecting Anomalous Program Behaviors. Proceedings of the IEEE Symposium on Security and Privacy, p.144, May 14-16, 2001