Clustering Malware via Measuring Similarity of Instruction Trace
碩士 === 國立交通大學 === 資訊科學與工程研究所 === 100 === Although a large number of malicious programs are created every day, most of them mutate from existing ones. These mutant malware programs may seemingly appear differently, but actually act with similar behavior patterns. By clustering these malware programs...
Main Authors: | , |
---|---|
Other Authors: | |
Format: | Others |
Language: | en_US |
Published: |
2011
|
Online Access: | http://ndltd.ncl.edu.tw/handle/59376726252762726733 |
id |
ndltd-TW-100NCTU5394036 |
---|---|
record_format |
oai_dc |
spelling |
ndltd-TW-100NCTU53940362015-10-13T20:37:27Z http://ndltd.ncl.edu.tw/handle/59376726252762726733 Clustering Malware via Measuring Similarity of Instruction Trace 利用指令軌跡的相似度進行惡意軟體分群 Chu, Ching-Feng 朱慶峯 碩士 國立交通大學 資訊科學與工程研究所 100 Although a large number of malicious programs are created every day, most of them mutate from existing ones. These mutant malware programs may seemingly appear differently, but actually act with similar behavior patterns. By clustering these malware programs into the same cluster, the malware analysis effort can be reduced significantly. In this paper, we propose a clustering approach to malware classification by comparing instruction trace similarity of binary programs being tested. We take advantage of dynamic analysis to trace malware instructions at runtime. Our method can discover malware in disguise by using techniques such as polymorphism or code injection. By tracing malware instructions, our scheme ensure that the detection mechanism cannot be circumvented or sabotaged by malicious API tampering. The taint technique we adopted can filter massive instructions created by normal system library as noise to the malware analysis. Collected instruction traces are then compared to measure their similarity so that the clustering can be performed. The results demonstrate that our system is able to cluster malware with similar codes, and can recognize new malware which is undetected by anti-virus tools. Shieh, Shiuh-Pyng 謝續平 2011 學位論文 ; thesis 39 en_US |
collection |
NDLTD |
language |
en_US |
format |
Others
|
sources |
NDLTD |
description |
碩士 === 國立交通大學 === 資訊科學與工程研究所 === 100 === Although a large number of malicious programs are created every day, most of them mutate from existing ones. These mutant malware programs may seemingly appear differently, but actually act with similar behavior patterns. By clustering these malware programs into the same cluster, the malware analysis effort can be reduced significantly. In this paper, we propose a clustering approach to malware classification by comparing instruction trace similarity of binary programs being tested. We take advantage of dynamic analysis to trace malware instructions at runtime. Our method can discover malware in disguise by using techniques such as polymorphism or code injection. By tracing malware instructions, our scheme ensure that the detection mechanism cannot be circumvented or sabotaged by malicious API tampering. The taint technique we adopted can filter massive instructions created by normal system library as noise to the malware analysis. Collected instruction traces are then compared to measure their similarity so that the clustering can be performed. The results demonstrate that our system is able to cluster malware with similar codes, and can recognize new malware which is undetected by anti-virus tools.
|
author2 |
Shieh, Shiuh-Pyng |
author_facet |
Shieh, Shiuh-Pyng Chu, Ching-Feng 朱慶峯 |
author |
Chu, Ching-Feng 朱慶峯 |
spellingShingle |
Chu, Ching-Feng 朱慶峯 Clustering Malware via Measuring Similarity of Instruction Trace |
author_sort |
Chu, Ching-Feng |
title |
Clustering Malware via Measuring Similarity of Instruction Trace |
title_short |
Clustering Malware via Measuring Similarity of Instruction Trace |
title_full |
Clustering Malware via Measuring Similarity of Instruction Trace |
title_fullStr |
Clustering Malware via Measuring Similarity of Instruction Trace |
title_full_unstemmed |
Clustering Malware via Measuring Similarity of Instruction Trace |
title_sort |
clustering malware via measuring similarity of instruction trace |
publishDate |
2011 |
url |
http://ndltd.ncl.edu.tw/handle/59376726252762726733 |
work_keys_str_mv |
AT chuchingfeng clusteringmalwareviameasuringsimilarityofinstructiontrace AT zhūqìngfēng clusteringmalwareviameasuringsimilarityofinstructiontrace AT chuchingfeng lìyòngzhǐlìngguǐjīdexiāngshìdùjìnxíngèyìruǎntǐfēnqún AT zhūqìngfēng lìyòngzhǐlìngguǐjīdexiāngshìdùjìnxíngèyìruǎntǐfēnqún |
_version_ |
1718049965698187264 |