Malicious Code Detection Based on Software Fingerprint

<p>Malicious code threatens the safety of computer systems. Researching malicious code design techniques and mastering code behavior patterns are the basic work of network security prevention. With the game of network offense and defense, malicious code shows the characteristics of invisibility, polymorphism, and multi-dismutation. How to correctly and effectively understand malicious code and extract the key malicious features is the main goal of malicious code detection technology. As an important method of program understanding, program slicing is used to analyze the program code by using the idea of “decomposition”, and then extract the code fragments that the analyst is interested in. In recent years, data mining and machine learning techniques have been applied to the field of malicious code detection. The reason why it has become the focus of research is that it can use data mining to dig out meaningful patterns from a large amount of existing code data. Machine learning can It helps to summarize the identification knowledge of known malicious code, so as to conduct similarity search and help find unknown malicious code. The machine learning heuristic malicious code detection method firstly needs to automatically or manually extract the structure, function and behavior characteristics of the malicious code, so we can first slice the malicious code and then perform the detection. Through the improvement of the classic program slicing algorithm, this paper effectively improves the slicing problem between binary code processes. At the same time, it implements a malicious code detection system. The machine code byte sequence variable-length N-gram is used as the feature extraction method to further prove that the efficiency and accuracy of malicious code detection technology based on data mining and machine learning. </p> <p> </p>

Cross site scripting (XSS) attacks are still one of the key threats to the security of web applications. With the increasingly evolving attack methods, traditional detection methods have a high false positive rate of detection results. This article proposes a new model: a cascaded detection architecture that combines Long Short Term Memory (LSTM) networks with Large Language Models (LLM) for detecting XSS malicious code attacks. This method first uses Word2vec for code vectorization, turning the malicious code into vector data predictable by LSTM. Then, LSTM detects the vectorized malicious code and classifies the samples as malicious , benign , or suspicious. The malicious code samples classified as suspicious will be sent to LLM for detailed analysis again. The experimental results obtained show that compared to independent LSTM for malicious code detection, the cascaded method of LSTM and LLM has an accuracy rate of up to 97.8% and a 42% reduction in false positive rate, especially for some Base64 and URL encoded malicious code detection with higher accuracy. At the same time, to ensure detection speed, only 8.3% of the malicious code samples were extracted for detection.

With the continuous increase in the economic value of new digital currencies represented by Bitcoin, more and more cybercriminals use malicious code to occupy victims system resources and network resources for mining without the victims permission, thereby obtaining cryptocurrency. This type of malicious code named malicious mining code has brought considerable influence and harm to society, enterprises and users. The mining code always conceals the fact that it consumes computer resources in a way that is difficult for ordinary people to discover. This paper proposes a malicious mining code detection method based on feature fusion and machine learning. First, we analyze from static analysis methods and statistical analysis methods to extract multi-dimensional features. Then for multi-dimensional text features, feature vectors are extracted through the n-gram model and TF-IDF, and best feature vectors are selected through the classifier and we fuse these best feature vectors with other statistic features to train our detection model. Finally, automatic detection is performed based on the machine learning framework. The experimental results show that the recognition accuracy of our method can reach 98.0%, its f1 score reach 0.969, and the ROCs AUC reach 0.973.

The computer malicious executable code has been with us for a quite long time. Since computer hardware and Internet is growing so fast today, security threats of malicious executable code are getting more serious. Basically, malicious executable codes are categorized into three kinds. The first is called virus, which always infect other benign programs. The second is called Trojan which always masquerade its malicious executable code inside a usefully utility or freeware program. And the last but not the least is called worm that replicate and distribute itself automatically around the network. According to the literature survey [R.A. Grimes (2001)], current antivirus products cannot detect all the malicious codes, especially for those unseen, polymorphism malicious executable codes. Moreover, there are many virus program generators and mutation engines available on public Web sites that can be downloaded freely make a lot of unseen, polymorphism, and harmful executable malicious code. So how to extract virus signatures efficiently and effectively automatically instead of manually for an antivirus scanner system is quite important and also is the major purpose of this research.

We can use information and software of various forms without being restricted for place and time if ubiquitous computing age comes. However, its dysfunction is causing security problems such as outflow of personal information, hacking, diffusion of virus. Specially, dissemination of software that has malicious purpose in ubiquitous computing environment causes serious damage. We have studied about malicious code detection and software vulnerability detection tool to prevent this. But, existent detection tools are not suited to general software, because they are limitative in specification area. In addition, they can not detect a newly appeared malicious code. We must update pattern of new malicious code, because they use a simple pattern matching technique. In this paper, we propose rule-based auditing system that analyzes structure of target code to solve these problems, define this as rule, and detect malicious codes and software vulnerabilities. Proposed auditing system can construct secure ubiquitous computing environment, because it will be used by a common software audit system that reason about source codes security.

E-mail attacks and spear phishing attacks, which have been pretended as corporations and civil servants, are occurring frequently. Phishing is used to steal user’s personal or financial information by redirecting users to web-sites hosted with malicious code. Malware is becoming more and more intelligent as it combines with social engineering techniques, causing damage to companies, organization, or users through e-mail or web sites. Attackers who create malware use a variety of techniques, such as disrupting and delaying analysis to increase malware’s life time. Anti-debugging techniques interferes with malware analysis and make it more difficult to analysis. We introduce five functions and one data structure that malware uses for anti-debugging techniques. We propose and verify a method for disabling anti-debugging techniques for such malware which have been protected by packing and anti-debugging techniques in user level debugger. This can be expected to make it easier for malware analysts to analyze malware that includes anti-debugging techniques.

In this article, the methods for constructing antivirus programs, their advantages and disadvantages are considered. The file PE-structure of malicious and safe software was analyzed. The signs that are typical for classes of malware such as Worm, Backdoor, Trojan and for the safe software were identified. A software model of the device for detecting malicious software based on the neural network ART-1 was developed. This system was trained on the example of the obtained binary vectors. Optimal similarity coefficients were found, and the testing was performed. The test results showed the possibility of using the developed system to detect modified malicious software. Figs.: 3. Tabl.: 4. Refs.: 10 titles.Keywords: antivirus scanner; malicious; PE-structure; software; ART-1 neural network; optimal similarity coefficients.

Malicious code is one of the biggest threats to cyberspace. In all kinds of network security incidents, malicious code is the main attack vector. At present, the traditional malicious code analysis methods based on feature and signature cannot meet the requirement of detection of malicious code. It is urgent for anti-virus manufacturers to explore and research more accurate and efficient malicious code detection and countermeasure mechanism. Through analyzing the format structure information of malicious code samples and combining with the extreme learning machine algorithm in machine learning, this paper studies the malicious code classification technology on the basis of the existing research, and designs the classification algorithm of malicious code family based on extreme learning. Experimental results show that the proposed technical method can effectively realize the classification of malicious code family, with the accuracy of classification more than 90%.

In Web3.0 distributed applications, the research on malicious code detection technology of binary and WASM bytecode files aims to meet the security challenges brought by the emerging Internet phase.This study proposes MalRing method and detection method based on N-gram feature extraction and gradient boosting tree for binary files on traditional platforms and WASM bytecode files in browser environments, respectively.The MalRing method utilizes multimodal fusion features (combining control flow graph and byte flow) for malicious code detection, and processes the features through node feature segmentation algorithm and ring domain extraction algorithm to deal with adversarial samples of control flow confusion.Experiments have shown that MalRing outperforms the baseline model in terms of accuracy.For WASM bytecode files, this study adopts the N-gram feature extraction method, selects features through out of bag errors, and fits the feature vectors using gradient boosting trees to obtain an algorithm model for malicious code detection.However, there are still some issues in current research, such as the high cost of binary file sample parsing and structural feature extraction, the lack of controllability and granularity in adversarial sample generation methods, and the lack of validation of WASM bytecode detection methods in practical systems.Therefore, future research directions will include optimizing sample parsing methods, improving adversarial sample generation methods, and enhancing the malicious code detection system for WASM bytecode, in order to improve the accuracy and efficiency of malicious code detection and provide strong support for the secure development of the Web3.0 ecosystem.

Malware homology analysis aims at detecting whether different malicious code originates from the same set of malicious code or is written by the same author or team, and whether it has intrinsic relevance and similarity. At the same time, the homology analysis of malicious code is also an important part of studying the groups behind different APT (Advanced Persistent Threat) attacks. At present, homology identification still relies on manual analysis and security experts' experience in the anti-malware industry. In addition, research on large-scale malicious code automated homology analysis is still insufficient. The method proposed in this paper is to solve the problem of large-scale malicious code homology automatic analysis, and hope to provide auxiliary information for discovering the group behind the APT attack. In this paper, we collected samples of different APT groups from public threat intelligence and proposed a novel approach to classify these samples into different APT groups to further analyze the homology of malware. We combined the CFG (Control Flow Graph) of the malicious code function and the disassembled code of the stripped malware to generate the embedding, i.e., a numeric vector, which formed a function feature database of the APT group, and presented a neural network model used for APT group classification. We have implemented our approach in a prototype system called MCrab. Our extensive evaluation showed that MCrab could produce high accuracy results, with few to no false positives. Our research also showed that deep learning can be successfully applied to malware homology analysis.

This thesis focuses on antivirus evasion techniques. It examines how an antivirus engine operates and studies various evasion methods for each antivirus operation. Subsequently, it investigates the level of difficulty in bypassing an antivirus by manual modification of malware code to escape detection. Finally, several open-sourced antivirus evasion tools are compared against the top award-winning antivirus products to evaluate their effectiveness.

By repackaging a malicious code into reverse compiled legitimate mobile code, malware authors can bypass detection step on existing mobile vaccine software using inserting AES-encrypted root exploits to loading some payload from a malicious remote server dynamically. In this case, malicious codes are constantly changing to evade detection steps by continuing its evolution by operating a metamorphic code by adding new propagation vectors, functionality, and stealth techniques to hide its presence and evade the detection of antivirus software. Those metamorphic features are aimed at changing the form of each instance of the malware by using encryption or appended/pre-pended dummy code into internal code of mobile apps. Therefore, we propose a new system to determine and detect metamorphic malicious mobile code by extracting dynamic features activated from Android platform using extended dynamic analysis technique.

By repackaging a malicious code into reverse compiled legitimate mobile code, malware authors can bypass detection step on existing mobile vaccine software using inserting AES-encrypted root exploits to loading some payload from a malicious remote server dynamically. In this case, malicious codes are constantly changing to evade detection steps by continuing its evolution by operating a metamorphic code by adding new propagation vectors, functionality, and stealth techniques to hide its presence and evade the detection of antivirus software. Those metamorphic features are aimed at changing the form of each instance of the malware by using encryption or appended/pre-pended dummy code into internal code of mobile apps. Therefore, we propose a new system to determine and detect metamorphic malicious mobile code by extracting dynamic features activated from Android platform using extended dynamic analysis technique.

The Early Detection, Alert and Response (eDare) system is aimed at purifying Web traffic propagating via the premises of Network Service Providers (NSP) from malicious code. To achieve this goal, the system employs powerful network traffic scanners capable of cleaning traffic from known malicious code. The remaining traffic is monitored and Machine Learning (ML) algorithms are invoked in an attempt to pinpoint unknown malicious code exhibiting suspicious morphological patterns. Decision trees, Neural Networks and Bayesian Networks are used for static code analysis in order to determine whether a suspicious executable file actually inhabits malicious code. These algorithms are being evaluated and preliminary results are encouraging.

As malicious codes become more complex and sophisticated, the scanning detection method is no longer able to detect various forms of viruses effectively. In this paper, we explore solutions based on multiple classifiers fusion and not strictly dependent on certain malicious code. Motivated by the standard signature-based technique for detecting viruses, we explore the idea of automatically detecting malicious code using the n-gram analysis. After selecting features based on information gain, the probabilistic neural network is used in the process of building and testing the proposed multi-classifiers system. Each one of the individual classifiers is used to produce classification evidences. Then these evidences are combined by the Dempster-Shafer combination rules to form the final classification results for new malicious code. Experimental results produced by the proposed detection engine shows improvement compared to the classification results produced by the individual classifiers.