近年来,使用恶意Excel 4.0宏(XLM)文档的攻击迎来了爆发,而XLM代码往往经过复杂的混淆,现有方法或检测系统难以分析海量样本的真实功能。因此,针对恶意样本中使用的各类混淆技术,基于抽象语法树和模拟执行,设计和实现了包含138个宏函数...近年来,使用恶意Excel 4.0宏(XLM)文档的攻击迎来了爆发,而XLM代码往往经过复杂的混淆,现有方法或检测系统难以分析海量样本的真实功能。因此,针对恶意样本中使用的各类混淆技术,基于抽象语法树和模拟执行,设计和实现了包含138个宏函数处理程序的自动化XLM反混淆与关键威胁指标(IOC,indicators of compromise)提取系统XLMRevealer;在此基础上,根据XLM代码特点提取Word和Token特征,通过特征融合能够捕获多层次细粒度特征,并在XLMRevealer中构造CNN-BiLSTM(convolution neural network-bidirectional long short term memory)模型,从不同维度挖掘家族样本的关联性和完成家族分类。最后,从5个来源构建包含2346个样本的数据集并用于反混淆实验和家族分类实验。实验结果表明,XLMRevealer的反混淆成功率达到71.3%,相比XLMMacroDeobfuscator和SYMBEXCEL工具分别提高了20.8%和15.8%;反混淆效率稳定,平均耗时仅为0.512 s。XLMRevealer对去混淆XLM代码的家族分类准确率高达94.88%,效果优于所有基线模型,有效体现Word和Token特征融合的优势。此外,为探索反混淆对家族分类的影响,并考虑不同家族使用的混淆技术可能有所不同,模型会识别到混淆技术的特征,分别对反混淆前和反混淆后再统一混淆的XLM代码进行实验,家族分类准确率为89.58%、53.61%,证明模型能够学习混淆技术特征,更验证了反混淆对家族分类极大的促进作用。展开更多
In recent years,Power Shell has increasingly been reported as appearing in a variety of cyber attacks.However,because the PowerShell language is dynamic by design and can construct script fragments at different levels...In recent years,Power Shell has increasingly been reported as appearing in a variety of cyber attacks.However,because the PowerShell language is dynamic by design and can construct script fragments at different levels,state-of-the-art static analysis based Power Shell attack detection approaches are inherently vulnerable to obfuscations.In this paper,we design the first generic,effective,and lightweight deobfuscation approach for PowerShell scripts.To precisely identify the obfuscated script fragments,we define obfuscation based on the differences in the impacts on the abstract syntax trees of PowerShell scripts and propose a novel emulation-based recovery technology.Furthermore,we design the first semantic-aware PowerShell attack detection system that leverages the classic objective-oriented association mining algorithm and newly identifies 31 semantic signatures.The experimental results on 2342 benign samples and 4141 malicious samples show that our deobfuscation method takes less than 0.5 s on average and increases the similarity between the obfuscated and original scripts from 0.5%to 93.2%.By deploying our deobfuscation method,the attack detection rates for Windows Defender and VirusTotal increase substantially from 0.33%and 2.65%to 78.9%and 94.0%,respectively.Moreover,our detection system outperforms both existing tools with a 96.7%true positive rate and a 0%false positive rate on average.展开更多
The smart phone market is continuously increasing and there are more than 6 billion of smart phone users worldwide with the aid of the 5G technology.Among them Android occupies 87%of the market share.Naturally,the wid...The smart phone market is continuously increasing and there are more than 6 billion of smart phone users worldwide with the aid of the 5G technology.Among them Android occupies 87%of the market share.Naturally,the widespread Android smartphones has drawn the attention of the attackers who implement and spread malware.Consequently,currently the number of malware targeting Android mobile phones is ever increasing.Therefore,it is a critical task to find and detect malicious behaviors of malware in a timely manner.However,unfortunately,attackers use a variety of obfuscation techniques for malware to evade or delay detection.When an obfuscation technique such as the class encryption is applied to a malicious application,we cannot obtain any information through a static analysis regarding its malicious behaviors.Hence,we need to rely on the manual,dynamic analysis to find concealed malicious behaviors from obfuscated malware.To avoid malware spreading out in larger scale,we need an automated deobfuscation approach that accurately deobfuscates obfuscated malware so that we can reveal hidden malicious behaviors.In this study,we introduce widely-used obfuscation techniques and propose an effective deobfuscation method,named ARBDroid,for automatically deobfuscating the string encryption,class encryption,and API hiding techniques.Our evaluation results clearly demonstrate that our approach can deobfuscate obfuscated applications based on dynamic analysis results.展开更多
文摘近年来,使用恶意Excel 4.0宏(XLM)文档的攻击迎来了爆发,而XLM代码往往经过复杂的混淆,现有方法或检测系统难以分析海量样本的真实功能。因此,针对恶意样本中使用的各类混淆技术,基于抽象语法树和模拟执行,设计和实现了包含138个宏函数处理程序的自动化XLM反混淆与关键威胁指标(IOC,indicators of compromise)提取系统XLMRevealer;在此基础上,根据XLM代码特点提取Word和Token特征,通过特征融合能够捕获多层次细粒度特征,并在XLMRevealer中构造CNN-BiLSTM(convolution neural network-bidirectional long short term memory)模型,从不同维度挖掘家族样本的关联性和完成家族分类。最后,从5个来源构建包含2346个样本的数据集并用于反混淆实验和家族分类实验。实验结果表明,XLMRevealer的反混淆成功率达到71.3%,相比XLMMacroDeobfuscator和SYMBEXCEL工具分别提高了20.8%和15.8%;反混淆效率稳定,平均耗时仅为0.512 s。XLMRevealer对去混淆XLM代码的家族分类准确率高达94.88%,效果优于所有基线模型,有效体现Word和Token特征融合的优势。此外,为探索反混淆对家族分类的影响,并考虑不同家族使用的混淆技术可能有所不同,模型会识别到混淆技术的特征,分别对反混淆前和反混淆后再统一混淆的XLM代码进行实验,家族分类准确率为89.58%、53.61%,证明模型能够学习混淆技术特征,更验证了反混淆对家族分类极大的促进作用。
基金supported by the National Natural Science Foundation of China(No.U1936215)。
文摘In recent years,Power Shell has increasingly been reported as appearing in a variety of cyber attacks.However,because the PowerShell language is dynamic by design and can construct script fragments at different levels,state-of-the-art static analysis based Power Shell attack detection approaches are inherently vulnerable to obfuscations.In this paper,we design the first generic,effective,and lightweight deobfuscation approach for PowerShell scripts.To precisely identify the obfuscated script fragments,we define obfuscation based on the differences in the impacts on the abstract syntax trees of PowerShell scripts and propose a novel emulation-based recovery technology.Furthermore,we design the first semantic-aware PowerShell attack detection system that leverages the classic objective-oriented association mining algorithm and newly identifies 31 semantic signatures.The experimental results on 2342 benign samples and 4141 malicious samples show that our deobfuscation method takes less than 0.5 s on average and increases the similarity between the obfuscated and original scripts from 0.5%to 93.2%.By deploying our deobfuscation method,the attack detection rates for Windows Defender and VirusTotal increase substantially from 0.33%and 2.65%to 78.9%and 94.0%,respectively.Moreover,our detection system outperforms both existing tools with a 96.7%true positive rate and a 0%false positive rate on average.
基金This work was supported as part of Military Crypto Research Center(UD210027XD)funded by Defense Acquisition Program Administration(DAPA)and Agency for Defense Development(ADD).
文摘The smart phone market is continuously increasing and there are more than 6 billion of smart phone users worldwide with the aid of the 5G technology.Among them Android occupies 87%of the market share.Naturally,the widespread Android smartphones has drawn the attention of the attackers who implement and spread malware.Consequently,currently the number of malware targeting Android mobile phones is ever increasing.Therefore,it is a critical task to find and detect malicious behaviors of malware in a timely manner.However,unfortunately,attackers use a variety of obfuscation techniques for malware to evade or delay detection.When an obfuscation technique such as the class encryption is applied to a malicious application,we cannot obtain any information through a static analysis regarding its malicious behaviors.Hence,we need to rely on the manual,dynamic analysis to find concealed malicious behaviors from obfuscated malware.To avoid malware spreading out in larger scale,we need an automated deobfuscation approach that accurately deobfuscates obfuscated malware so that we can reveal hidden malicious behaviors.In this study,we introduce widely-used obfuscation techniques and propose an effective deobfuscation method,named ARBDroid,for automatically deobfuscating the string encryption,class encryption,and API hiding techniques.Our evaluation results clearly demonstrate that our approach can deobfuscate obfuscated applications based on dynamic analysis results.
