![](https://csdnimg.cn/release/download_crawler_static/18497577/bg1.jpg)
CBM: Free, Automatic Malware Analysis Framework Using
API Call Sequences
ABSTRACT
Classic static code analysis for malware is ineffective when
challenged by diverse variants. As a result, dynamic analysis
based on malware behavior is becoming thriving in malware
research. Most current dynamic analysis systems are provid-
ed as online services for common users. It is inconvenient
and ineffective to use online services for the analysis of a big
malware data set. In this paper, we propose a framework
named CBM enable tailored construction of an automated
system for malware analysis. CBM integrates and improves
multiple open-source software tools. API call sequences are
extracted as malware behavior reports by Cuckoo Sandbox.
Then API calls are transformed to byte-based sequential da-
ta for further analysis by a novel malware behavior repre-
senting method called BBIS. Malheur is employed for clus-
tering. We fo cus on improvement of the monitoring capabil-
ity by appending new API hooks and propose an algorithm
called CARL to reduce the high repeatability in API call-
ing. We also test the robustness of clustering by utilizing
multi-distance functions. Experiments were carried out on
a large-scale malware data set. The results demonstrate that
CBM is valuable for malware analysis being efficient in stor-
age and computation cost. In addition, its performance in
clustering is comparable to the state-of-art analysis frame-
work CMM(CWSandbox/MIST/Malheur).
1. INTRODUCTION
Malware, as malicious software, is the basement for at-
tackers to implement intrusions and maintain them. Con-
ventional methods disassemble the malware to carry out de-
tailed analysis on the malware at the assembly code level.
There are two prerequisites in such situation: one is that the
researchers should have deep technical insights of assembly;
the other is that the analysis processes should be efficient
enough to cope with the constant renewal and variation of
the malware. The widespread packing and obfuscation tech-
nology utilized by malware make it even more challenging.
Dynamic analysis based on behaviors provides a new per-
Permission to make digital or hard copies of all or part of this work for
personal or classroom use is granted without fee provided that copies are
not made or distributed for profit or commercial advantage and that copies
bear this notice and the full citation on the first page. To copy otherwise, to
republish, to post on servers or to redistribute to lists, requires prior specific
permission and/or a fee.
ACSAC ’2012 Orlando, Florida USA
Copyright 20XX ACM X-XXXXX-XX-X/XX/XX ...$10.00.
spective to analyze malware. Different from static code
analysis, it runs malware in a controlled environment called
sandbox and gets the behaviors triggered by malware upon
the operation system. With this technique, we can perform
the malware analysis automatically at a large scale. Several
systems have been implemented, such as CWSandbox [21],
Anubis[2], Norman
1
, ThreatExpert
2
, etc.. Most of them
provide free service for the submission and online analysis
of malware binaries.
Source codes or packages for local installation are not
available for those systems. Moreover, above tools have
limitations on the number of submissions and the size of
malware executable, which limits their usage in large scale
analysis. Therefore in this paper we propose a framework for
a locally deployable system for automatic malware analysis.
This framework would enable a fully controllable analysis
procedure under your control. Our framework is based on
two open source systems: Cuckoo sandbox
3
and Malheur[14].
Our contributions can be listed as follows:
- Reasonable integration solution. We proposed an au-
tomatic malware analysis framework CBM based on
the improvement and integration of the existed open
source system Cuckoo sandbox and Malheur. CBM
can abstract the analysis reports from Cuckoo sand-
box and encode the reports to sequential data for Mal-
heur to perform clustering and classification analysis.
To achieve a high precision and high adaptability, we
introduce the method to append the monitoring API
functions in Cuckoo sandbox and expand the vector
distance calculation functions in Malheur.
- BBIS (Byte-based Behavior Instruction Set) and CAR-
L (Compression Algorithm of high Repeatability in
Logarithmic level). We designed BBIS to transform
Cuckoo sandbox’s analysis reports and make them rec-
ognizable by the Malheur system. In theory, BBIS can
maintain a minimum size of reports while keeping the
full features needed. CARL can further compress the
reports by means of reducing the high repeatability
in API calling while making negligible influences upon
malware’s clustering results.
- Evaluation on a large-scale malware data set. We have
achieved a 90% precision of clustering while using CB-
M to analyze the dataset of 3131 malware binaries,
1
http://www.norman.com/
2
http://threatexpert.com/
3
http://www.cuckoobox.org/