簡易檢索 / 詳目顯示

研究生: 吳家毅
Chia-Yi Wu
論文名稱: 透過重新定義函式呼叫圖嵌入進行物聯網惡意軟體家族分類
Classifying IoT Malware Based on Redefined Function-Call-Graph Embedding
指導教授: 鄭欣明
Shin-Ming Cheng
口試委員: 陳嘉玫
Chia-Mei Chen
黃俊穎
Chun-Ying Huang
蕭舜文
Shun-Wen Hsiao
學位類別: 碩士
Master
系所名稱: 電資學院 - 資訊工程系
Department of Computer Science and Information Engineering
論文出版年: 2022
畢業學年度: 110
語文別: 中文
論文頁數: 61
中文關鍵詞: 資訊安全物聯網惡意軟體機器學習惡意軟體分析靜態分析
外文關鍵詞: Cybersecurity, IoT malware, Machine learning, Malware analysis, Static analysis
相關次數: 點閱:331下載:0
分享至:
查詢本校圖書館目錄 查詢臺灣博碩士論文知識加值系統 勘誤回報

  • Contents Abstract in Chinese . . . . . . . . . . . . . . . . . . . . . . . . . . iii Abstract in English . . . . . . . . . . . . . . . . . . . . . . . . . . iv Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v List of Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii List of Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix List of Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2 Background and Related work . . . . . . . . . . . . . . . . . . 7 2.0.1 IoT malware . . . . . . . . . . . . . . . . . . . . 7 2.0.2 Previous work on malware analysis . . . . . . . . 8 3 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 3.0.1 Reverse Engineering . . . . . . . . . . . . . . . . 16 3.0.2 Redefining user-defined functions . . . . . . . . . 17 3.0.3 Feature Extraction . . . . . . . . . . . . . . . . . 20 3.0.4 Classification Methods . . . . . . . . . . . . . . . 25 4 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 v 4.0.1 Evaluation dataset . . . . . . . . . . . . . . . . . 27 4.0.2 Visualization . . . . . . . . . . . . . . . . . . . . 27 4.0.3 Parameter tuning . . . . . . . . . . . . . . . . . . 31 4.0.4 Evaluation metrics . . . . . . . . . . . . . . . . . 33 4.0.5 Performance evaluation . . . . . . . . . . . . . . 34 4.0.6 Performance comparison with related work . . . . 41 5 Discussions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 5.0.1 Limitation of static analysis . . . . . . . . . . . . 45 5.0.2 Application scenarios . . . . . . . . . . . . . . . . 46 5.0.3 Future work . . . . . . . . . . . . . . . . . . . . . 46 6 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

    [1] H. S. Galal, Y. B. Mahdy, and M. A. Atiea, “Behavior-based features model for malware detection,”
    arXiv preprint arXiv:1612.04433, vol. 12, pp. 59–67, Dec. 2016.
    [2] A. Costin and J. Zaddach, “IoT malware: Comprehensive survey, analysis framework and case studies,” in Proc. BlackHat USA 2018, Aug. 2018.
    [3] M. Wazzan, D. Algazzawi, O. Bamasaq, A. Albeshri, and L. Cheng, “Internet of Things botnet detection approaches: Analysis and recommendations for future research,” Applied Sciences, vol. 11,
    no. 12, p. 5713, 2021.
    [4] M. Gallaher and B. Kropp, “The economic impacts of inadequate infrastructure for software testing,”
    05 2002.
    [5] A. Brucker and U. Sodan, “Deploying static application security testing on a large scale,” Lecture
    Notes in Informatics (LNI), Proceedings - Series of the Gesellschaft fur Informatik (GI), pp. 91–101,
    01 2014.
    [6] T.-L. Wan, T. Ban, S.-M. Cheng, Y.-T. Lee, B. Sun, R. Isawa, T. Takahashi, and D. Inoue, “Efficient
    detection and classification of Internet-of-Things malware based on byte sequences from executable
    files,” IEEE Open Journal of the Computer Society, vol. 1, pp. 262–275, Oct. 2020.
    [7] Q.-D. Ngo, H.-T. Nguyen, H.-A. Tran, and D.-H. Nguyen, “IoT botnet detection based on the integration of static and dynamic vector features,” in Proc. IEEE ICCE 2020, Jan 2021.
    [8] H. Alasmary, A. Khormali, A. Anwar, J. Park, J. Choi, A. Abusnaina, A. Awad, D. Nyang, and A. Mohaisen, “Analyzing and detecting emerging Internet of Things malware: A graph-based approach,”
    vol. 6, pp. 8977–8988, Oct. 2019.
    [9] Q.-D. Ngo, H.-T. Nguyen, V.-H. Le, and D.-H. Nguyen, “A survey of IoT malware and detection
    methods based on static features,” ICT Express, vol. 6, pp. 280–286, Dec. 2020.
    [10] R. Kawasoe, C. Han, R. Isawa, T. Takahashi, and J. Takahashi, “Investigating behavioral differences
    between IoT malware via function call sequence graphs,” in Proc. ACM SAC, pp. 1674–1682, Mar.
    2021.
    [11] C. Li, G. Shen, and W. Sun, “Cross-architecture intemet-of-things malware detection based on graph
    neural network,” in Proc. IJCNN 2021, pp. 1–7, 2021.
    [12] H.-T. Nguyen, Q.-D. Ngo, and V.-H. Le, “A novel graph-based approach for IoT botnet detection,”
    IJISS, vol. 19, pp. 567–577, June 2020.
    [13] M. Antonakakis et al., “Understanding the Mirai botnet,” in Proc. USENIX Security 2017, pp. 1093–
    1110, Aug. 2017.
    49
    [14] A. Marzano, D. Alexander, O. Fonseca, E. Fazzion, C. Hoepers, K. Steding-Jessen, M. H. Chaves,
    Í. Cunha, D. Guedes, and W. Meira, “The evolution of bashlite and mirai IoT botnets,” in Proc. IEEE
    ISCC 2018, pp. 813–818, June 2018.
    [15] Guardian, “Ddos attack that disrupted internet was largest of its kind in history, experts say.” "https:
    //www.theguardian.com/technology/2016/oct/26/ddos-attack-dyn-mirai-botnet".
    [16] S. Herwig, K. Harvey, G. Hughey, R. Roberts, and D. Levin, “Measurement and analysis of hajime, a
    peer-to-peer iot botnet,” in Network and Distributed Systems Security (NDSS) Symposium, 2019.
    [17] E. Raff, J. Barker, J. Sylvester, R. Brandon, B. Catanzaro, and C. Nicholas, “Malware detection by
    eating a whole EXE,” in Proc. AAAI 2018, Oct. 2018.
    [18] J. Su, D. V. Vasconcellos, S. Prasad, D. Sgandurra, Y. Feng, and K. Sakurai, “Lightweight classification of IoT malware based on image recognition,” in Proc. IEEE COMPSAC 2018, pp. 664–669, July
    2018.
    [19] B. Kang, S. Y. Yerima, K. McLaughlin, and S. Sezer, “N-opcode analysis for android malware classification and categorization,” in Proc. Cyber Security 2016, pp. 1–7, 2016.
    [20] S. Gülmez and I. Sogukpinar, “Graph-based malware detection using opcode sequences,” in Proc.
    ISDFS 2021, pp. 1–5, 2021.
    [21] F. Ou and J. Xu, “S3feature: A static sensitive subgraph-based feature for android malware detection,”
    Computers & Security, vol. 112, p. 102513, 2022.
    [22] F. Xiao, Y. Sun, D. Du, X. Li, and M. Luo, “A novel malware classification method based on crucial
    behavior,” Mathematical Problems in Engineering, vol. 2020, Mar. 2020.
    [23] Y. Zhang, X. Chang, Y. Lin, J. Mišić, and V. B. Mišić, “Exploring function call graph vectorization
    and file statistical features in malicious PE file classification,” IEEE Access, vol. 8, pp. 44652–44660,
    Mar. 2020.
    [24] F. Shahzad and M. Farooq, “ELF-Miner: Using structural knowledge and data mining methods to
    detect new Linux malicious executables,” Knowledge and Information Systems, vol. 30, pp. 589–612,
    Mar. 2012.
    [25] Y.-T. Lee, T. Ban, T.-L. Wan, S.-M. Cheng, R. Isawa, T. Takahashi, and D. Inoue, “Cross platform
    IoT-malware family classification based on printable strings,” in Proc. IEEE TrustCom 2020, Dec
    2020.
    [26] C.-Y. Wu, T. Ban, S.-M. Cheng, B. Sun, and T. Takahashi, “IoT malware detection using functioncall-graph embedding,” in Proc. PST 2021, pp. 1–9, 2021.
    [27] “Radare2.” https://rada.re/r/.
    [28] A. Narayanan, M. Chandramohan, R. Venkatesan, L. Chen, Y. Liu, and S. Jaiswal, “graph2vec: Learning distributed representations of graphs,” arXiv preprint arXiv:1707.05005, July 2017.
    50
    [29] W. H. Greene, Econometric analysis, vol. Pearson series in economics. Pearson Education, 7th ed.,
    international ed ed., 2012.
    [30] F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and
    E. Duchesnay, “Scikit-learn: Machine learning in Python,” Journal of Machine Learning Research,
    vol. 12, pp. 2825–2830, 2011.
    [31] G. Sood, virustotal: R Client for the virustotal API, 2017. R package version 0.2.1.
    [32] L. McInnes, J. Healy, and J. Melville, “Umap: Uniform manifold approximation and projection for
    dimension reduction,” arXiv preprint arXiv:1802.03426, Feb 2018.
    [33] S. Schrittwieser and S. Katzenbeisser, “Code obfuscation against static and dynamic reverse engineering,” in Information Hiding (T. Filler, T. Pevný, S. Craver, and A. Ker, eds.), (Berlin, Heidelberg),
    pp. 270–284, Springer Berlin Heidelberg, 2011.
    [34] H. Aghakhani, F. Gritti, F. Mecca, M. Lindorfer, S. Ortolani, D. Balzarotti, G. Vigna, and C. Kruegel,
    “When malware is packin’ heat; limits of machine learning classifiers based on static analysis features,” in NDSS, 2020.

    無法下載圖示 全文公開日期 2027/08/01 (校內網路)
    全文公開日期 2027/08/01 (校外網路)
    全文公開日期 2027/08/01 (國家圖書館:臺灣博碩士論文系統)
    QR CODE