Successive memory image analysis method for malicious codes

Wei-ming LI; De-qing ZOU; Guo-zhong SUN

doi:10.11959/j.issn.2096-109x.2017.00144

您当前的位置：

首页 >

文章列表页 >

Successive memory image analysis method for malicious codes

Academic paper | 更新时间：2024-06-03

- Successive memory image analysis method for malicious codes
- Chinese Journal of Network and Information Security Vol. 3, Issue 2, Pages: 20-30(2017)
- 作者机构：
  
  1. 华中科技大学计算机学院，湖北武汉 430074
  2. 曙光信息产业有限公司，北京 100080
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00144
  CLC： TP309
- Online First：2017-02，
  
  Published：15 February 2017
- 稿件说明：
移动端阅览
Wei-ming LI, De-qing ZOU, Guo-zhong SUN. Successive memory image analysis method for malicious codes[J]. Chinese Journal of Network and Information Security, 2017, 3(2): 20-30.
DOI：

Wei-ming LI, De-qing ZOU, Guo-zhong SUN. Successive memory image analysis method for malicious codes[J]. Chinese Journal of Network and Information Security, 2017, 3(2): 20-30. DOI： 10.11959/j.issn.2096-109x.2017.00144.

摘要

为了更加全面地检测恶意代码的行为，提出连续内存镜像分析技术。核心是在QEMU虚拟机中运行恶意代码样本，获取样本运行时期连续增量的内存镜像，然后按照时序解析为多个完整的内存镜像。在单个内存镜像分析的基础上，对不同时刻内存镜像做对比分析。同时设计运用可视化工具D3.js，以图表的形式直观动态地展示系统运行过程中内存状态的变化。最后实现原型系统，通过对40种恶意代码样本进行测试，检测出的恶意代码行为数量在传统单镜像内存分析的基础上增加了19.7%。

Abstract

In order to detect the behavior of malicious code more comprehensively

the technology of continuous memory image analysis was proposed. The core idea was to run malicious code in QEMU virtual machine

to obtain the memory image of the continuous increment in the running period

and then to analyze the memory image of the base and increment as the memory image. On the basis of the analysis of a single memory image

different memory images were analysised comparatively. At the same time

the visualization tool D3.js was used to visually display the change of the memory state in the process of system operation. Finally

the prototype system was tested by 40 kinds of malicious code samples

and the number of malicious code behavior was increased by 19.7% than traditional sin-gle memory image.

关键词

Keywords

references

2014-2015中国互联网安全研究报告 [R ] ．猎豹移动安全实验室， 2015 .

2014-2015 Report of China Internet security study [R ] . Cheetah Mo-bile Security Laboratory , 2015 .

ROLLES R . Unpacking virtualization obfuscators [C ] // The 3rd USENIX Conference on Offensive Technologies . 2009 : 1 .

WALTERS A A , PETRONI N L . Volatools: integrating volatile memory into the digital investigation process [C ] // Black Hat DC . 2007 : 9 - 20 .

殷联甫．计算机取证中的物理内存取证分析方法研究 [J ] . 计算机应用与软件， 2010 , 27 ( 12 ): 295 - 298 .

YIN L F . Study of physical memory forensic analysis method in computer forensics [J ] . Computer Application and Software , 2010 , 27 ( 12 ): 295 - 298 .

DOLAN-GAVITT B . Forensic analysis of the Windows registry in memory [J ] . Digital Investigation . 2008 , 5 ( 1 ): S26 - S32 .

OKOLICA J , PETERSON G L . Windows operating systems agnostic memory analysis [J ] . Digital Investigation . 2010 ( 7 ): S48 - S56 .

KORNBLUM J . Exploiting the Rootkit paradox with Windows memory analysis [J ] . International Journal of Digital Evidence Fall . 2006 , 5 ( 1 ): 4 .

STEVENS R M , CASEY E . Extracting Windows command line details from physical memory [J ] . Digital investigation . 2010 ( 7 ): S57 - S63 .

BERGERON J , DEBBABI M , DESHARNAIS J , et al . Static detec-tion of malicious code in executable programs [C ] // BIBUV . 2005 : 1 - 5 .

YIN H , SONG D , EGELE M , et al . Panorama: capturing sys-tem-wide information flow for malware detection and analysis [C ] // The 14th ACM Conference on Computer and Communications Security . 2007 : 116 - 127 .

WILLEMS C . CWSandbox: automatic behaviour analysis of mal-ware [J ] . Digital Investigation . 2013 , 3 ( 4 ): 97 - 12 .

Views

1816

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Review of malware detection and classification visualization techniques

Research on parallel coordinate visualization technology based on principal component analysis and K-means clustering

Visualization analysis and design of DDoS attack

Related Author

Jinwei WANG

Zhengjia CHEN

Xue XIE

Xiangyang LUO

Bin MA

Guo-jun MA

Shui-bo WANG

Qing-qi PEI

Related Institution

Engineering Research Center of Digital Forensics, Ministry of Education, Nanjing University of Information Science and Technology

Department of Computer, Nanjing University of Information Science and Technology

State Key Laboratory of Mathematical Engineering and Advanced Computing

University of Science and Technology of China

China Aerospace Academy of Systems Science and Engineering

⁰