파일 DNA 기반의 변종 악성코드 탐지를 위한 유사도 비교에 관한 연구

다국어 초록 (Multilingual Abstract)

This paper studied the detection technique using file DNA-based behavior pattern analysis in order to minimize damage to user system by malicious programs before signature or security patch is released. The file DNA-based detection technique was applied to defend against zero day attack and to minimize false detection, by remedying weaknesses of the conventional network-based packet detection technique and process-based detection technique. For the file DNA-based detection technique, abnormal behaviors of malware were splitted into network-related behaviors and process-related behaviors. This technique was employed to check and block crucial behaviors of process and network behaviors operating in user system, according to the fixed conditions, to analyze the similarity of behavior patterns of malware, based on the file DNA which process behaviors and network behaviors are mixed, and to deal with it rapidly through hazard warning and cut-off.

참고문헌 (Reference)

1 박남열, "우회기법을 이용하는 악성코드 행위기반 탐지 방법" 한국정보보호학회 16 (16): 17-28, 2006

2 Matthew M. Williamson, "Using Behavior to Detect and Classification Information-Stealing Malware"

3 A. Sung, "Static Analyzer for Vicious Executable(SAVE)" 326-334, 2004

4 Alex Ship, "Heuristic Detection of Viruses within E-mail, Virus Bulletin Paper" 2001

5 Baudorin Le Charlier, "Dynamic detection and classification of computer viruses using general behavior patterns" 20-22, 1995

6 John Aycock, "Computer Viruses and Mallware"

7 Matthew Evan Wagner, "Behavior Oriented Detection of Malicious Code at Run-Time" F.I.T Pater 2004

8 장은겸, "A Study on Comparison of Road Surface Images to Provide Information on Specific Road Conditions" 한국컴퓨터정보학회 17 (17): 31-39, 2012