恶意软件洞察：通过攻击点加速逆向工程
Malware Sight-Seeing: Accelerating Reverse-Engineering via Point-of-Interest-Beacons
摘要：
新型恶意软件正以令人担忧的速度出现。然而，通过逆向工程分析恶意软件仍然是一项耗时且主要是手动的任务。出于这个原因，有必要开发自动化部分逆向工程过程的技术，并可以规避现代恶意软件的内置对策。本文的主要贡献是一种新的方法来自动找到所谓的兴趣点（POI）在执行的程序。POI是与分析师已知的数据交互的指令。它们可以用作恶意软件分析中的信标，并可以帮助引导分析人员找到恶意软件的有趣部分。此外，我们提出了一个指标的POI，所谓的置信度分数，估计如何专门的POI将处理相关的恶意软件的数据。随着自动提取对等体的P2P僵尸网络恶意软件的目标，我们证明和评估我们的方法，通过将其应用于四个僵尸网络（ZeroAccess，Sality，Nugache和Kelihos）。我们研究了已知IP和端口的已识别POI，并通过使用此信息，利用它成功监控僵尸网络。此外，使用我们的评分系统，我们表明，我们可以提取同行的每个僵尸网络具有很高的准确性。
英文摘要：
New types of malware are emerging at concerning rates. However, analyzing malware via reverse engineering is still a time-consuming and mostly manual task. For this reason, it is necessary to develop techniques that automate parts of the reverse engineering process and that can evade the built-in countermeasures of modern malware. The main contribution of this paper is a novel method to automatically find so-called Points-of-Interest (POIs) in executed programs. POIs are instructions that interact with data that is known to an analyst. They can be used as beacons in the analysis of malware and can help to guide the analyst to the interesting parts of the malware. Furthermore, we propose a metric for POIs , the so-called confidence score that estimates how exclusively a POI will process data relevant to the malware. With the goal of automatically extract peers in P2P botnet malware, we demonstrate and evaluate our approach by applying it on four botnets (ZeroAccess, Sality, Nugache, and Kelihos). We looked into the identified POIs for known IPs and ports and, by using this information, leverage it to successfully monitor the botnets. Furthermore, using our scoring system, we show that we can extract peers for each botnet with high accuracy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
