스팸메일로 전파되는 악성코드의 분석 및 대응 프레임워크

초록

Spam is one of the methods to propagate malware, and malware authors mainly use social engineering means in order to get Internet users open spam and execute an attached malware. In this paper, we analyze the malware which is attached in the spam by categorizing them into behavior analysis and network traffic analysis and propose defense mechanisms based on the result. As a results of analyzing the behavior in system and network traffic, it was observed that this malware creates new files, registries, key log files in newly infected machines. Furthermore, we inferred that malware sent spam to user's e-mail addresses from cookie files, communicated with specific server continuously and downloaded other malware. With this analyzed result, we propose the defense mechanism in order to detect sending spam and block it by analyzing the behavior of malware which sends spam and the features of spam.

키워드