Polymorphic Worm Detection Using Structural Information of Executables Summary. v0nsch3lling

Transcription

1 Polymorphic Worm Detection Using Structural Information of Executables Summary v0nsch3lling

2 Introduction paper author : Christopher Kruegel affiliation : Technical University of Vienna publish date : 2005

3 Introduction identify different mutation/variants of the same worm using the structure properties based on CFG(Control Flow Graph)

4 Introduction contribution fingerprinting technique based on control flow information evaluation of fingerprinting technique that is based on a color scheme

5 Fingerprinting Worms properties for fingerprinting techniques(1/3) uniqueness different executable - different fingerprint different executable - identical fingerprints : false positive

6 Fingerprinting Worms properties for fingerprinting techniques(2/3) robustness to insertion and deletion the fingerprint is not affected by code insertion & deletion the remaining fragment is identified as part of the original executable robustness to modification

7 Fingerprinting Worms properties for fingerprinting techniques(3/3) robustness to modification maybe insertion & deletion is same story... but, modification means code sequence modification robustness to junk insertion, renaming, transposition, substitution...

8 Fingerprinting Worms for example, the byte strings as fingerprint uniqueness, robustness to insertion & deletion properties are fulfilled but, byte strings is sensitive to modification so attacker can evade this scheme easily

9 Fingerprinting Worms what fulfills three requirements?(1/2) CFG = {basic block + edge} i renaming, insertion, substitution, and instruction reordering(2nd, 3st requirement) have no influence on CFG basic block layout modification has influence on CFG but, solve this problem by comparison method

10 Fingerprinting Worms what fulfills three requirements?(2/2) comparison of CFG just entire CFG comparison is not effective... so identifying common substructures of 2 cfgs

11 Control Flow Graph Extraction step1. disassemble from network stream step2. create a CFG

12 K-Subgraphs & Graph Coloring k-subgraphs invoke for each basic block & perform a depth-first traversal of the graph generate a spanning tree, remove edges there is only one path from a node to another node

13 Graph Fingerprinting number off these k-subgraphs the number is a fingerprint but, only if two k-subgraphs are isomorphic, two fingerprints is equal this is a canonical graph labeling problem

14 Graph Fingerprinting canonical representation problem finding the canonical form of a graph is so difficult but, there is Nauty Library : handle vertex-colored directed graphs

15 Graph Fingerprinting generate fingerprint(1/2) adjacency matrix : rows and columns labeled by graph vertices with 1(there is a edge between vertices) or 0 generate fingerprint from adjacency matrix concatenate rows

16 Graph Fingerprinting generate fingerprint

17 Graph Coloring limitation of structural information based identification ignore machine instruction semantic so graph coloring technique classify instruction according to semantic

18 Graph Coloring there is 14 color classes - 14bit color value limitation same mean & different representation : different color class but, the probability is low

19 Graph Coloring limitation of structural information based identification ignore machine instruction semantic so graph coloring technique classify instruction according to semantic

20 Evaluation

21 Limitations off-line prototype system disassemble time for generating CFG malicious code(< k blocks)