基于虚拟机内省的恶意软件行为分析与家族分析
Virtual Machine Introspection Based Malware Behavior Profiling and Family Grouping
摘要：
恶意软件的扩散归因于少数原始恶意软件源代码的更改。同源交替出现的恶意软件具有一些共同的内在行为，形成了一个恶意软件家族。当恶意软件首次出现在互联网上时，识别其恶意软件家族可以为减轻威胁提供有用的线索。本文提出了一个恶意软件分析器（VMP），利用虚拟机内省（VMI）技术来分析恶意软件的执行行为。VMP在虚拟机监视器（VMM）中插入插件，以记录调用的API调用及其输入参数和返回值作为恶意软件的配置文件。在本文中，流行的相似性度量Jaccard距离和系统发生树的构建方法来发现恶意软件家族。对恶意软件配置文件的研究表明，来自恶意软件家族的恶意软件彼此非常相似，并且与其他恶意软件家族以及良性软件不同。本文还研究了VMP对现有的反恶意软件检测引擎和一些著名的恶意软件分组方法，比较其恶意软件家族的建设的好处。提出了一种对等投票方法，结果表明，VMP是优于几乎所有的反恶意软件引擎比较，并与微调文本挖掘方法和高阶N-gram方法兼容。我们还建立了一个基于VMP的恶意软件分析网站，用于恶意软件研究。
英文摘要：
The proliferation of malwares have been attributed to the alternations of a handful of original malware source codes. The malwares alternated from the same origin share some intrinsic behaviors and form a malware family. Expediently, identifying its malware family when a malware is first seen on the Internet can provide useful clues to mitigate the threat. In this paper, a malware profiler (VMP) is proposed to profile the execution behaviors of a malware by leveraging virtual machine introspection (VMI) technique. The VMP inserts plug-ins inside the virtual machine monitor (VMM) to record the invoked API calls with their input parameters and return values as the profile of malware. In this paper, a popular similarity measurement Jaccard distance and a phylogenetic tree construction method are adopted to discover malware families. The studies of malware profiles show the malwares from a malware family are very similar to each others and distinct from other malware families as well as benign software. This paper also examines VMP against existing anti-malware detection engines and some well-known malware grouping methods to compare the goodness in their malware family constructions. A peer voting approach is proposed and the results show VMP is better than almost all of the compared anti-malware engines, and compatible with the fine tuned text-mining approach and high order N-gram approaches. We also establish a malware profiling website based on VMP for malware research.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
