惡意軟體資料庫：收集、分析與評鑑

Database of Malware: Collection, Analysis and Evaluation

朱彥曦(Yen-Hsi Chu)

指導教授 ： 曾俊元

國立臺北大學/商學院/資訊管理研究所/碩士(2013年)

摘要

本研究之目的在於建立一套收集惡意程式，針對惡意程式進行分析並且加以評鑑之平台。以往如要測試防毒軟體或是入侵偵測系統的效能，勢必得選定一組「題庫」，也就是惡意軟體或是病毒庫來確定其是否有達到一定的效能。唯選擇一個客觀且難易兼具的惡意程式來測試防毒軟體以及入侵偵測系統變成了一個課題。本研究建立了一個採用主動式收集技術收集惡意軟體，並且結合惡意軟體分析與評鑑的平台，透過大量收集、即時分析以及樣本分群以取得惡意軟體的偵測率、類型以及發現日期，藉以了解惡意軟體之惡意程度並且依照這些結果制定出評鑑惡意軟體的指標，為最後測試題庫的建立打下良好的基礎。本研究所建立之平台已收集超過34,000個可疑軟體並持續增加中，多數惡意軟體也已經分析與評鑑完畢。透過這樣一個結合惡意軟體收集、分析以及評鑑，且全自動化的平台，我們可以迅速地得到大量可疑軟體，並且針對惡意軟體進行分析以利日後的分群，以建立起測試惡意軟體以及入侵偵測系統之良好題庫。

關鍵字

惡意軟體收集,惡意軟體分析,惡意軟體評鑑

並列摘要

This research aims at building a malware collection, analysis and evaluation platform. In before times, if we wanted to test the performance of anti-virus, we had to build the “sample bank” which means a set of malware to test the antivirus in order to ensuring that anti-virus is capable of detection. While how to select proper malware to group sample bank has become a major issue. To deal with this, we have established a platform with proactive malware collection, analysis and evaluation. Through massive collection we can acquire various suspicious files and upload these files to VirusTotal for detection. The detection result will be taken as basis to evaluate the files. We have also built a new malware evaluation mechanism to classify the malware, which was found based on detection result. The suspicious files collected will be evaluated and the result shows the new evaluation mechanism has outputted a set of highly malicious and changed suspicious files which might be suitable for examining the anti-viruses. With automatically functioned, the platform can get and have sample evaluated rapidly for further malware classification based on evaluation result in order to building well-quality malware question bank.

並列關鍵字

malware collection, malware analysis, malware evaluation

參考文獻

[17] 戴維炫, "信譽基準的權重投票以減少入侵偵測的誤判漏判," 交通大學網路工程研究所學位論文, 2011.

[5] L. Spitzner , “Honeypots: tracking hackers”, Addison-Wesley Professional

[16] P. Bishop, et al., "Diversity for Security: A Study with Off-the-Shelf AntiVirus Engines," in Software Reliability Engineering (ISSRE), 2011 IEEE 22nd International Symposium on, 2011, pp. 11-19.

[1] NCC資通安全設備防毒閘道器採購參考指引

[2] Jun Zhang, “Storm worm & botnet analysis”, Websense Security Labs