Automated deobfuscation and family classification system for Excel 4.0 macros

LI Chenguang; YANG Xiuzhang; PENG Guojun

doi:10.11959/issn.2096-109x.2024040

您当前的位置：

首页 >

文章列表页 >

Automated deobfuscation and family classification system for Excel 4.0 macros

Papers | 更新时间：2024-08-14

- Automated deobfuscation and family classification system for Excel 4.0 macros
- Chinese Journal of Network and Information Security Vol. 10, Issue 3, Pages: 66-80(2024)
- 作者机构：
  
  武汉大学国家网络安全学院，湖北武汉 430072
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(62172308;U1636107;61972297;62172144);Cyber Security School Student Innovation Funding Program of Office of the Central Cyberspace Affairs Commission
- DOI：10.11959/issn.2096-109x.2024040
  CLC： TP393
- Received：26 December 2023，
  
  Revised：2024-04-10，
  
  Published：25 June 2024
- 稿件说明：
移动端阅览
李晨光, 杨秀璋, 彭国军. Excel 4.0宏自动化反混淆与家族分类系统[J]. 网络与信息安全学报, 2024, 10(3): 66-80.

LI C G, YANG X Z, PENG G J. Automated deobfuscation and family classification system for Excel 4.0 macros[J]. Chinese Journal of Network and Information Security, 2024, 10(3): 66-80.
李晨光, 杨秀璋, 彭国军. Excel 4.0宏自动化反混淆与家族分类系统[J]. 网络与信息安全学报, 2024, 10(3): 66-80. DOI： 10.11959/issn.2096-109x.2024040.

LI C G, YANG X Z, PENG G J. Automated deobfuscation and family classification system for Excel 4.0 macros[J]. Chinese Journal of Network and Information Security, 2024, 10(3): 66-80. DOI： 10.11959/issn.2096-109x.2024040.

摘要

近年来，使用恶意Excel 4.0宏（XLM）文档的攻击迎来了爆发，而XLM代码往往经过复杂的混淆，现有方法或检测系统难以分析海量样本的真实功能。因此，针对恶意样本中使用的各类混淆技术，基于抽象语法树和模拟执行，设计和实现了包含138个宏函数处理程序的自动化XLM反混淆与关键威胁指标（IOC，indicators of compromise）提取系统XLMRevealer；在此基础上，根据XLM代码特点提取Word和Token特征，通过特征融合能够捕获多层次细粒度特征，并在XLMRevealer中构造CNN-BiLSTM（convolution neural network-bidirectional long short term memory）模型，从不同维度挖掘家族样本的关联性和完成家族分类。最后，从5个来源构建包含2 346个样本的数据集并用于反混淆实验和家族分类实验。实验结果表明，XLMRevealer的反混淆成功率达到71.3%，相比XLMMacroDeobfuscator和SYMBEXCEL工具分别提高了20.8%和15.8%；反混淆效率稳定，平均耗时仅为0.512 s。XLMRevealer对去混淆XLM代码的家族分类准确率高达94.88%，效果优于所有基线模型，有效体现Word和Token特征融合的优势。此外，为探索反混淆对家族分类的影响，并考虑不同家族使用的混淆技术可能有所不同，模型会识别到混淆技术的特征，分别对反混淆前和反混淆后再统一混淆的XLM代码进行实验，家族分类准确率为89.58%、53.61%，证明模型能够学习混淆技术特征，更验证了反混淆对家族分类极大的促进作用。

Abstract

In recent years

a surge has been witnessed in cyber-attacks that leverage malicious Excel 4.0 macros (XLM) within documents. Malicious XLM codes often undergo complex obfuscation

posing a substantial challenge for conventional analysis methods and detection systems to discern the actual functionality within a vast array of samples. Consequently

an automated system for deobfuscating XLM and extracting key Indicators of Compromise (IOCs)

named XLMRevealer

was developed to counter the diverse obfuscation strategies employed in malicious samples. XLMRevealer was architected upon abstract syntax trees and execution simulation

encompassing 138 comprehensive macro function handlers. Based on that

Word and Token features tailored to XLM code peculiarities were extracted

capturing multi-level

fine-grained features through feature fusion. XLMRevealer incorporated a CNNBiLSTM model to discern familial correlations across dimensions

facilitating family classification. Finally

a dataset comprising 2346 samples from five distinct sources was constructed for both deobfuscation and family classification experiments. Results indicated that XLMRevealer achieved a 71.3% deobfuscation success rate

outperforming XLMMacroDeobfuscator and SYMBEXCEL by 20.8% and 15.8%

respectively. Its efficiency was stable

with an average processing time of only 0.512 seconds. The family classification accuracy for deobfuscated XLM codes stood at 94.88%

surpassing all baseline models and underscoring the efficacy of Word and Token feature integration. Furthermore

to assess the impact of deobfuscation on family classification and account for variability in obfuscation techniques across families

experiments were conducted on both the original and uniformly obfuscated XLM codes. The accuracies were 89.58% and 53.61%

respectively

demonstrating the model's capability to learn obfuscation features and confirming the significant enhancement deobfuscation provides for family classification.

关键词

Keywords

references

RUARO N , PAGANI F , ORTOLANI S , et al . SYMBEXCEL: automated analysis and understanding of malicious Excel 4.0 macros [C ] // Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2022 : 1066 - 1081 .

YAN J , WAN M , JIA X K , et al . DitDetector: bimodal learning based on deceptive image and text for macro malware detection [C ] // Proceedings of the 38th Annual Computer Security Applications Conference . New York : ACM , 2022 : 227 - 239 .

MIURA H , MIMURA M , TANAKA H . Macros finder: do you remember LOVELETTER? [C ] // International Conference on Information Security Practice and Experience . Cham : Springer , 2018 : 3 - 18 .

KIM S , HONG S , OH J , et al . Obfuscated VBA macro detection using machine learning [C ] // Proceedings of the 2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2018 : 490 - 501 .

MIMURA M , OHMINAMI T . Towards efficient detection of malicious VBA macros with LSI [C ] // International Workshop on Security . Cham : Springer , 2019 : 168 - 185 .

MIMURA M , MIURA H . Detecting unseen malicious VBA macros with NLP techniques [J ] . Journal of Information Processing , 2019 , 27 : 555 - 563 .

LAIN D , KOSTIAINEN K , ČAPKUN S . Phishing in organizations: findings from a large-scale and long-term study [C ] // Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2022 : 842 - 859 .

宋文纳 , 彭国军 , 傅建明 , 等 . 恶意代码演化与溯源技术研究 [J ] . 软件学报 , 2019 , 30 ( 8 ): 2229 - 2267 .

SONG W N , PENG G J , FU J M , et al . Research on malicious code evolution and traceability technology [J ] . Journal of Software , 2019 , 30 ( 8 ): 2229 - 2267 .

LE Q V , MIKOLOV T , JIA H F , et al . Distributed representations of sentences and documents [EB ] . arXiv Preprint arXiv: 1405. 4053 . 2014 .

HENDLER D , KELS S , RUBIN A . Detecting malicious PowerShell commands using deep neural networks [C ] // Proceedings of the 2018 on Asia Conference on Computer and Communications Security . New York : ACM , 2018 : 187 - 197 .

HENDLER D , KELS S , RUBIN A . AMSI-based detection of malicious PowerShell code using contextual embeddings [C ] // Proceedings of the 15th ACM Asia Conference on Computer and Communications Security . New York : ACM , 2020 : 679 - 693 .

MIKOLOV T , CHEN K , CORRADO G , et al . Efficient estimation of word representations in vector space [EB ] . arXiv Preprint arXiv: 1301. 3781 . 2013 .

TAJIRI Y , MIMURA M . Detection of malicious PowerShell using word-level language models [C ] //AOKI K, KANAOKA A. International Workshop on Security . Cham : Springer , 2020 : 39 - 56 .

AL-TAHARWA I A , LEE H M , JENG A B , et al . JSOD: JavaScript obfuscation detector [J ] . Security and Communication Networks , 2015 , 8 ( 6 ): 1092 - 1107 .

LUONG T , SUTSKEVER I , LE Q , et al . Addressing the rare word problem in neural machine translation [C ] // Proceedings of the 53rd Annual Meeting of the Association for Computational Linguistics and the 7th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) . Stroudsburg, PA, USA : Association for Computational Linguistics , 2015 : 11 - 19 .

YANG X Z , PENG G J , ZHANG D N , et al . PowerDetector: Malicious PowerShell script family classification based on multi-modal semantic fusion and deep learning [J ] . China Communications , 2023 , 20 ( 11 ): 202 - 224 .

HUANG Z H , XU W , YU K . Bidirectional LSTM-CRF models for sequence tagging [J ] . arXiv Preprint arXiv: 1508. 01991 . 2015

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Malware classification method based on static multiple-feature fusion

Related Author

Bo-wen SUN

Yan-yi HUANG

Qiao-kun WEN

Bin TIAN

Peng WU

Qi LI

Related Institution

Beijing Key Laboratory of Interconnection and Integration,School of Cyberspace Security,Beijing University of Post and Telecommunications

International School,Beijing University of Post and Telecommunications

China Information Technology Security Evaluation Center

College of Computer Science Sichuan University

⁰