精确的系统级关联恶意软件解包
Precise system-wide concatic malware unpacking
摘要：
运行时间打包是恶意软件用来混淆其有效载荷的常见方法，因此，自动解包是高度相关的。这一问题受到了广泛的关注，到目前为止，基于动态分析的解决方案是最成功的。然而，现有的解决方案在概念上和架构上都缺乏几个方面，因为它们只关注解包问题的有限部分。这些限制显著影响了它们的适用性，因此，当前的解包器的采用有限。在本文中，我们介绍了一种新的工具，称为密涅瓦，有效的自动解包的恶意软件样本。Minerva引入了一种统一的方法，可以精确地发现打包的恶意软件样本中的执行波，并生成非常适合后续静态分析的PE文件。在核心，Minerva部署了一个新的信息流模型，包括系统范围内动态生成的代码、API调用的精确收集以及合并执行波和API调用的新方法。总之，这些新颖性增强了自动解包的通用性和精确性，并使Minerva的输出具有高度可用性。我们广泛评估密涅瓦对合成和现实世界的恶意软件样本，并表明，我们的技术显着提高了几个方面相比，以前的工作。
英文摘要：
Run time packing is a common approach malware use to obfuscate their payloads, and automatic unpacking is, therefore, highly relevant. The problem has received much attention, and so far, solutions based on dynamic analysis have been the most successful. Nevertheless, existing solutions lack in several areas, both conceptually and architecturally, because they focus on a limited part of the unpacking problem. These limitations significantly impact their applicability, and current unpackers have, therefore, experienced limited adoption. In this paper, we introduce a new tool, called Minerva, for effective automatic unpacking of malware samples. Minerva introduces a unified approach to precisely uncover execution waves in a packed malware sample and produce PE files that are well-suited for follow-up static analysis. At the core, Minerva deploys a novel information flow model of system-wide dynamically generated code, precise collection of API calls and a new approach for merging execution waves and API calls. Together, these novelties amplify the generality and precision of automatic unpacking and make the output of Minerva highly usable. We extensively evaluate Minerva against synthetic and real-world malware samples and show that our techniques significantly improve on several aspects compared to previous work.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
