명령어 출현 시퀀스를 사용한 악성코드 패밀리 탐지 방법

초록

Malware variant is a metamorphic malware to avoid malware detection systems and consists a malware family with others which have the same origin. It is hard to detect those malware variants because metamorphic techniques can change the signature of the origin. In this paper, we propose a malware family detection method using instruction frequency. Instruction frequency would be similar between malware variants in the same malware family. For the instruction frequency comparison, we extract the longest common sub-sequence (LCS) from two instruction sequences which are sorted instructions by each instruction frequency and calculate the ratio of LCS size as the similarity of them. In the experiment, our method showed the good performance of malwrae family deteciton.

키워드