基於資訊流之應用程式行為模型

Information Flow Based Application Behavior Modeling

李泓暐(Hong-Wei Li)

指導教授 ： 吳育松

國立交通大學/資訊學院/資訊科學與工程研究所/碩士(2014年)

https://doi.org/10.6842/NCTU.2014.00759

摘要

我們提出了一個基於資訊流的應用程式行為模型，該模型強調應用程式執行時所造成系統物件間的資訊流。資訊流不止是包含底層物件的屬性，同時也表現出物件間的關聯性，此外，此模型支援用正規表示式來做詢問。我們展示將模型套用在惡意行為識別應用上，並且在Xen虛擬化平台上建立一個雛型行為引擎，該行為引擎在對客戶端透明的情況下攔截客戶端所執行的系統呼叫，接著將系統呼叫軌跡轉換成上述的模型，使其能夠接受正規表示式來做詢問。實驗部分確認雛型系統能夠將未知的惡意軟體行為比對出來，被監控的客戶端系統仍可維持80%的原有效能。

關鍵字

資訊流 ； 應用程式行為

並列摘要

We propose an application behavior model based on information flow. The model focuses on the flow of information among system objects due to the execution of an application. A flow encompasses not only the attributes of its underlying objects but also the relations between the objects. The model supports efficient query through regular expressions. We have shown that the model is applicable to practical applications such as the identification of malicious behavior of unknown malware. We built a prototype behavior engine on top of Xen virtualization platform. The behavior engine transparently monitors the guest system calls, convert the system call trace into the information flow behavior model, and allows queries of application behavior through regular expressions. The evaluation confirms that the prototype system can indeed support behavior matching of unknown malware and incurs only a mild 20% performance overhead on the monitored guest system.

並列關鍵字

information flow ； application behavior

參考文獻

[5] J. Kwon and H. Lee, "Bingraph: Discovering mutant malware using hierarchical semantic signatures," in Malicious and Unwanted Software (MALWARE), the 7th International Conference on, 2012, pp. 104-111.

[6] M. Fredrikson, S. Jha, M. Christodorescu, R. Sailer, and X. Yan, "Synthesizing near-optimal malware specifications from suspicious behaviors," in Security and Privacy, IEEE Symposium on, 2010, pp. 45-60.

[7] Sandhu, Ravi S., et al. "Role-based access control models." Computer 29.2 (1996): 38-47.

[8] Denning, Dorothy E., "A lattice model of secure information flow", Communications of the ACM 19.5 (1976): 236-243.

[10] H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda, "Panorama: capturing system-wide information flow for malware detection and analysis," in Proceedings of the 14th ACM conference on Computer and communications security, 2007, pp. 116-127.