CBM: Free, Automatic Malware Analysis Framework Using
API Call Sequences
ABSTRACT
Classic static code analysis for malware is ineffective when
challenged by diverse variants. As a result, dynamic analysis
based on malware behavior is becoming thriving in malware
research. Most current dynamic analysis systems are provid-
ed as online services for common users. It is inconvenient
and ineffective to use online services for the analysis of a big
malware data set. In this paper, we propose a framework
named CBM enable tailored construction of an automated
system for malware analysis. CBM integrates and improves
multiple open-source software tools. API call sequences are
extracted as malware behavior reports by Cuckoo Sandbox.
Then API calls are transformed to byte-based sequential da-
ta for further analysis by a novel malware behavior repre-
senting method called BBIS. Malheur is employed for clus-
tering. We fo cus on improvement of the monitoring capabil-
ity by appending new API hooks and propose an algorithm
called CARL to reduce the high repeatability in API call-
ing. We also test the robustness of clustering by utilizing
multi-distance functions. Experiments were carried out on
a large-scale malware data set. The results demonstrate that
CBM is valuable for malware analysis being efficient in stor-
age and computation cost. In addition, its performance in
clustering is comparable to the state-of-art analysis frame-
work CMM(CWSandbox/MIST/Malheur).
1. INTRODUCTION
Malware, as malicious software, is the basement for at-
tackers to implement intrusions and maintain them. Con-
ventional methods disassemble the malware to carry out de-
tailed analysis on the malware at the assembly code level.
There are two prerequisites in such situation: one is that the
researchers should have deep technical insights of assembly;
the other is that the analysis processes should be efficient
enough to cope with the constant renewal and variation of
the malware. The widespread packing and obfuscation tech-
nology utilized by malware make it even more challenging.
Dynamic analysis based on behaviors provides a new per-
Permission to make digital or hard copies of all or part of this work for
personal or classroom use is granted without fee provided that copies are
not made or distributed for profit or commercial advantage and that copies
bear this notice and the full citation on the first page. To copy otherwise, to
republish, to post on servers or to redistribute to lists, requires prior specific
permission and/or a fee.
ACSAC ’2012 Orlando, Florida USA
Copyright 20XX ACM X-XXXXX-XX-X/XX/XX ...$10.00.
spective to analyze malware. Different from static code
analysis, it runs malware in a controlled environment called
sandbox and gets the behaviors triggered by malware upon
the operation system. With this technique, we can perform
the malware analysis automatically at a large scale. Several
systems have been implemented, such as CWSandbox [21],
Anubis[2], Norman
1
, ThreatExpert
2
, etc.. Most of them
provide free service for the submission and online analysis
of malware binaries.
Source codes or packages for local installation are not
available for those systems. Moreover, above tools have
limitations on the number of submissions and the size of
malware executable, which limits their usage in large scale
analysis. Therefore in this paper we propose a framework for
a locally deployable system for automatic malware analysis.
This framework would enable a fully controllable analysis
procedure under your control. Our framework is based on
two open source systems: Cuckoo sandbox
3
and Malheur[14].
Our contributions can be listed as follows:
- Reasonable integration solution. We proposed an au-
tomatic malware analysis framework CBM based on
the improvement and integration of the existed open
source system Cuckoo sandbox and Malheur. CBM
can abstract the analysis reports from Cuckoo sand-
box and encode the reports to sequential data for Mal-
heur to perform clustering and classification analysis.
To achieve a high precision and high adaptability, we
introduce the method to append the monitoring API
functions in Cuckoo sandbox and expand the vector
distance calculation functions in Malheur.
- BBIS (Byte-based Behavior Instruction Set) and CAR-
L (Compression Algorithm of high Repeatability in
Logarithmic level). We designed BBIS to transform
Cuckoo sandbox’s analysis reports and make them rec-
ognizable by the Malheur system. In theory, BBIS can
maintain a minimum size of reports while keeping the
full features needed. CARL can further compress the
reports by means of reducing the high repeatability
in API calling while making negligible influences upon
malware’s clustering results.
- Evaluation on a large-scale malware data set. We have
achieved a 90% precision of clustering while using CB-
M to analyze the dataset of 3131 malware binaries,
1
http://www.norman.com/
2
http://threatexpert.com/
3
http://www.cuckoobox.org/
下载后可阅读完整内容，剩余9页未读，立即下载
weixin_38714910
- 粉丝: 4
- 资源: 921
我的内容管理
展开
最新资源
- 解决本地连接丢失无法上网的问题
- BIOS报警声音解析：故障原因与解决方法
- 广义均值移动跟踪算法在视频目标跟踪中的应用研究
- C++Builder快捷键大全：高效编程的秘密武器
- 网页制作入门：常用代码详解
- TX2440A开发板网络远程监控系统移植教程：易搭建与通用解决方案
- WebLogic10虚拟内存配置详解与优化技巧
- C#网络编程深度解析：Socket基础与应用
- 掌握Struts1：Java MVC轻量级框架详解
- 20个必备CSS代码段提升Web开发效率
- CSS样式大全：字体、文本、列表样式详解
- Proteus元件库大全：从基础到高级组件
- 74HC08芯片：高速CMOS四输入与门详细资料
- C#获取当前路径的多种方法详解
- 修复MySQL乱码问题：设置字符集为GB2312
- C语言的诞生与演进：从汇编到系统编程的革命
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
