基於Quark引擎之Android應用程式惡意行為偵測規則自動化生成系統

隨著智慧型行動裝置時代來臨，Android已成為高市佔率之行動裝置作業系統，因此駭客也逐漸以Android裝置作為其犯罪標的。Quark引擎為一開源之Android惡意程式分析工具，惡意程式分析師可透過Quark引擎產出之分析情資，快速定位樣本之惡意行為。Quark引擎亦為rule-based偵測引擎，亦即偵測規則數量與其實用性成正比。然而，若以人工撰寫規則，所需勞務成本過高，且規則品質取決於惡意程式分析師資安經驗多寡。因此，Quark團隊過往已研發出兩代自動化規則生成系統，為改進前兩代規則產出效率低，以及人工篩選規則勞務成本過高之瓶頸，本研究提出第三代系統，並以兩種真實惡意程式樣本進行實驗，比較三個版本生成規則之命中率（有效規則數與生成規則數之比例）與規則生成率（生成規則數與計算量之比例）。實驗結果顯示，第三代自動化規則生成系統之命中率平均為49.6%，規則生成率平均為26.1%，皆遠高於前兩代系統。研究結果表明，第三代規則生成系統為最高效益之版本。然而，該系統仍有規則篩選流程優化，以及目標函式挑選流程優化之改進空間。本研究依照上述2點提出未來研究方向與建議。

關鍵字

Android ；惡意程式；偵測規則；分析情資；自動化生成規則

並列摘要

With the advent of the smartphone era, the Android operating system has the highest market share worldwide on mobile devices. Consequently, the Android platform has become the biggest target for threat actors. Quark Engine is an open-source Android malware analysis system that provides threat intelligence of Android malware. It helps threat researchers quickly detect the behavior in malware samples. Since Quark Engine is a rule-based system, the number of Quark rules is proportional to its practicality. However, manually creating rules is time and effort consuming. In addition, the quality of Quark rules depends on the experience of the threat researcher. Therefore, The Quark team has developed two versions of Quark rule generation system. To improve the drawbacks of the systems, this study presents the third version of the rule generation system. We experiment with two different families of Android malware samples. The experiment compares accuracy (the ratio of effective rules number to output rules number) and productivity (the ratio of output rules number to the amount of computation). The result shows that the third version of the rule generation system has 41.5% accuracy and 26.1% productivity in average, which are both much higher than other versions of rule generation system. Thus, the result shows that the third version is the most efficient system. Last, we proposed several suggestions for improvements, including the process of rule selection and the target function selection.

並列關鍵字

Android ； Malware ； Detection rule ； Threat intelligence ； Rule generate

參考文獻

F. Laricchia, "Mobile operating systems’ market share worldwide from January 2012 to January 2022," 2 2021. [Online]. Available: https://www.statista.com/statistics/272698/global-market-share-held-by-mobile-operating-systems-since-2009/.