- PDF Free Download

Size: px

Start display at page:

Download ""

しほこことじ
5 years ago
Views:

3 LIME i

5 Abstract Of Bachelor Thesis Academic Year 2018 Machine Learning models indicating concrete criteria for malware analysis Summary Nowadays, malware has been threatening Internet security. To detect and classify malware, a lot of research and products using machine learning have been proposed, especially for end point detection. Whilst the research and products are arguing that they have high accuracy in various constraints, it is insufficient to give the models result from the perspective of malware analysts, for they want clues of results for further investigation. Especially in case of using complex models, it is much more difficult to know the clues. In this thesis we will present new machine learning models for malware analysis. the models will indicate not only detection result, but also concrete part of feature that are attributed to detection or classification result. To realize that, we will use algorithm called LIME to approximate complex machine learning models. As an examination, we use this models for ransomware classification and make sure that the extracted features are appropriate. By using this models, it is expected that malware analysts can take countermeasure for malware by getting the clues of classification result. Keywords Machine learning, Malware analysis, Data analysis Faculty of Law Keio University Kei Nomaguchi iii

7 LIME StackNet (1) (2) (1) API (2) API v

8 21 A 25 B 29 C 31 D 35 vi

9 LIME vii

10 Stacking CryptLocker Kovter Locker Reveton (2) B viii

11 : C2 OS 1

12 1.1.2 [15],

13 [21] 2.1: 2.1 C2 C2 3

14 2.1: CryptoLocker Wannacry Petya Badrabbit UIWIX Reveton Kovter C2 C2 Eternal Blue Windows Petya Wannacry FBI Ranscam [16]?? Wannacry[8] [29] Wannacry UIWIX[30] Petya[22] Badrabbit[7] : 4

15 [3] Khazar [17] Andrea [5] Khazar OS [18] Khazar Cylance [6] Saxe PE Deep Neural Netwoek [26] 5

16 [28] Deep Neural Network Zhou [31] 2017 [13] Deep Neural Network SVC [1] SVC Deep Neural Network [11] [20] [14] [2] 2017 Deep Neural Network [12] GAN [13] [9] 6

17 3 3.1 LIME StackNet : 7

18 3.1.2 LIME LIME[25] LIME : LIME ξ(x) = argmin g G L(f, g, π x ) + Ω(g) (3.1) x G g L x G Ω g g 8

19 : OS Ubuntu LTS LIME RISS 371 StackNet(scikit-learn , xgboost 0.7 ) Imperial College London RISS [27] API 3.2 API 1 3.2: CryptLocker 107 Kovter 64 Locker 97 Reveton StackNet StackNet [24] 1 9

20 Kaggle : Stacking SVC 2 RandomForest 4 Naive Bays 4 XGBoost 7 RandomForest Logistic Regression F (1) SVC w f = w 2 (w T (x p x n )) 2 (3.2) SVC SVC (2) Random Forest Random Forest K g = 1 p 2 (C i t) (3.3) i=1 10

21 (3) Naive Bays P (B A) = P (A B)P (B) P (A) (3.4) P (A) P (A B) N P (A B) = P (x i Y ) (3.5) i=1 (4) XGBoost Random Forest (5) Logistic Regression ϕ(z) = e z (3.6) 11

23 : (1) (2) API API (1) (1) Windows API 1 API API API (2) (2) LIME Win32/CTBLocker Win32/TorrentLocker 13

4.1: 6 1 1 4.2 4.2: CertOpenStore 0.06565736054979383 CryptAcquireContextA 0.09746892921246786 RtlAddVectoredExceptionHandler 0.059140259652749355 SetWindowsHookExA 0.

24 4.1: : CertOpenStore CryptAcquireContextA RtlAddVectoredExceptionHandler SetWindowsHookExA NtSetContextThread FindResourceExW CoInitializeSecurity NtTerminateThread NtAllocateVirtualMemory SetFilePointerEx VirtualFreeEx CertOpenSystemStoreA NtCreateMutant RtlDecompressBuffer

25 (1) API 4.3, 4.4, 4.5, : CryptLocker API API API API1 CryptAcquireContextA RtlDecompressBuffer SetFilePointerEx API2 4.4: Kovter API API API API1 CryptAcquireContextA InternetCloseHandle SetFilePointerEx API2 InternetOpenUrlW SetFileAttributesW 4.5: Locker API API API API1 CryptAcquireContextA InternetOpenUrlW GetFileSize API2 SetFileAttributesW 15

26 4.6: Reveton API API API API1 CryptAcquireContextA DnsQuery W SetFilePointerEx API2 CryptGenKey InternetCrackUrlW SetFileAttributesW (2) API : (2) StackNet 28 LIME

27 5 5.1 API 8 LIME

29 ,,,, Rodney D. Van Meter III, Sigma ISC Korry Luke Ko You Liang Aaron Tang Andrey Ferrryan Flo Costa SNS 2016 ROP exploitation 19

30 This one s dedicated to all the hackers. 20

31 [1] Daniel Arp, Michael Spreitzenbarth, Malte Hubner, Hugo Gascon, and Konrad Rieck. Drebin: Effective and explainable detection of android malware in your pocket, [2] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. CoRR, Vol. abs/ ,, [3] AV-TEST. AV-TEST The Independent IT-security Institute(Cited 12th December 2017). [4] Barun. Reversing the petya ransomware with constraint solvers(cited 12th December 2017). [5] Andrea Continella, Alessandro Guagnelli, Giovanni Zingaro, Giulio De Pasquale, Alessandro Barenghi, Stefano Zanero, and Federico Maggi. Shieldfs: A self-healing, ransomware-aware filesystem. In Proceedings of the 32nd Annual Computer Security Applications Conference. ACM, [6] Cylance. Cylance PROTECT(Cited 12th December 2017). [7] Endgame. BadRabbit Technical Analysis(Cited 12th December 2017). [8] Endgame. WCry/WanaCry Ransomware Technical Analysis(Cited 12th December 2017). [9] Hyrum Anderson Anant Kharkar Bobby Filar and Phil Roth. Evading machine learning malware detection. BlackHat USA, [10] Joseph Gardiner and Shishir Nagaraja. On the security of machine learning in malware c&c detection: A survey. ACM Comput. Surv., Vol. 49, No. 3, pp. 59:1 59:39, [11] I. Goodfellow, J. Shlens, and C. Szegedy. Explaining and Harnessing Adversarial Examples. ArXiv e-prints, December

32 [12] Kathrin Grosse, Nicolas Papernot, Praveen Manoharan, Michael Backes, and Patrick D. McDaniel. Adversarial perturbations against deep neural networks for malware classification. CoRR, Vol. abs/ ,, [13] Weiwei Hu and Ying Tan. Generating adversarial malware examples for black-box attacks based on GAN. CoRR, Vol. abs/ ,, [14] A. Ilyas, L. Engstrom, A. Athalye, and J. Lin. Query-Efficient Black-box Adversarial Examples. ArXiv e-prints, December [15] Heju Jiang, Jasvir Nagra, and Parvez Ahammad. Sok: Applying machine learning in security - A survey. CoRR, Vol. abs/ ,, [16] Kaspersky. Ranscam (Cited 12th December 2017). [17] Amin Kharaz, Sajjad Arshad, Collin Mulliner, William Robertson, and Engin Kirda. Unveil: A large-scale, automated approach to detecting ransomware. In 25th USENIX Security Symposium (USENIX Security 16), pp , Austin, TX, USENIX Association. [18] Amin Kharraz and Engin Kirda. Redemption: Real-time protection against ransomware at end-hosts. In Proceedings of the 20th International Symposium on Research in Attacks, Intrusions and Defenses (RAID), [19] Youngjoon Ki, Eunjin Kim, and Huy Kang Kim. A novel approach to detect malware based on api call sequence analysis. Int. J. Distrib. Sen. Netw., Vol. 2015, pp. 4:4 4:4, January [20] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. CoRR, Vol. abs/ ,, [21] Allan Liska and Timothy Gallo. Ransomware : Defending against digital extortion. O Reilly Media, Incorporated, p. 6, [22] Malwarebytes. Petya Taking Ransomware To The Low Level(Cited 12th December 2017). [23] Micheal Shikorski and Andrew Honig. Practical Malware Analysis: A Hands-On Guide to Dissecting Malicious Software. No Starch Press, p. 1, [24] Sebastian Raschka. Mlxtend, April [25] Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. why should I trust you? : Explaining the predictions of any classifier. CoRR, Vol. abs/ ,,

33 [26] Joshua Saxe and Konstantin Berlin. Deep neural network based malware detection using two dimensional binary program features. In Proceedings of the th International Conference on Malicious and Unwanted Software (MALWARE), MALWARE 15, pp , Washington, DC, USA, IEEE Computer Society. [27] Daniele Sgandurra, Luis Muñoz-González, Rabih Mohsen, and Emil C. Lupu. Automated dynamic analysis of ransomware: Benefits, limitations and use for detection. CoRR, Vol. abs/ ,, [28] Shun Tobiyama, Yukiko Yamaguchi, Hajime Shimada, Tomonori Ikuse, and Takeshi Yagi. Malware detection with deep neural network using process behavior IEEE 40th Annual Computer Software and Applications Conference (COMPSAC), Vol. 2, pp , [29] TrendMicro. WannaCry 2017 (Cited 12th December 2017). [30] TrendMicro. UIWIX WannaCry Wcry (Cited 12th December 2017). [31] Bolei Zhou, David Bau, Aude Oliva, and Antonio Torralba. Interpreting deep visual representations via network dissection. CoRR, Vol. abs/ ,, [32] Bolei Zhou, Aditya Khosla, Agata Lapedriza, Aude Oliva, and Antonio Torralba. Learning deep features for discriminative localization. CoRR, Vol. abs/ ,,

35 A label 0 NtDuplicateObject \_ getaddrinfo \_ InternetSetStatusCallback \_ NtReadVirtualMemory \_ LdrUnloadDll \_ VirtualFreeEx \_ GetDiskFreeSpaceExW \_ LookupPrivilegeValueW \_ InternetOpenUrlW \_ SetFilePointerEx \_ LdrLoadDll \_ SetFileAttributesW \_ label 2 CertOpenStore \_ CryptAcqui recontexta \_ RtlAddVectoredExceptionHandler \_ SetWindowsHookExA \_ NtSetContextThread \_ FindResourceExW \_ CoInitiali zesecurity \_ NtTerminateThread \_ NtAllocateVirtualMemory \_ SetFilePointerEx \_ VirtualFreeEx \_ CertOpenSy stemstorea \_ NtCreateMutant \_

36 RtlDecompressBuffer \_ label 5 CreateToolhelp32Snapshot \_ GetVolumePathNamesForVolumeNameW \_ NtGetContextThread \_ CryptAcquireContextA \_ GetShortPathNameW \_ VirtualFreeEx \_ SetFilePointerEx \_ InternetCloseHandle \_ NtDelayExecution \_ ShellExecuteExW \_ InternetOpenUrlW \_ SetFileAttributesW \_ NtFreeVirtualMemory \_ label 6 Process32NextW \_ CreateToolhelp32Snapshot \_ NtReadVirtualMemory \_0. CryptAcquireContextA \_ GetFileSize \_ LoadResource \_ FindResourceExW \_ CoInitializeSecurity \_ GetVolumePathNamesForVolumeNameW \_ NtTerminateThread \_ InternetOpenUrlW \_ NtAllocateVirtualMemory \_ GetComputerNameA \_ CreateDirectoryW \_ NtQue ryat tribu tesf ile \_ GetKeyState \_ MessageBoxTimeoutA \_

37 SetFileAttributesW \_ NtOpenProcess \_ NtGetContextThread \_ label 9 GetVolumePathNamesForVolumeNameW \_ CreateToolhelp32Snapshot \_ SetFilePointerEx \_ RtlAddVectoredExceptionHandler \_ CryptAcqui recontexta \_ LdrUnloadDll \_ CreateServiceA \_ OpenSCManagerW \_ NtSetInfor mationfile \_ InternetCrackUrlW \_ LdrGetProcedureAddress \_ FindResourceW \_ DnsQuery \_W\_ ShellExecuteExW \_ SetFileAttributesW \_ NtOpenProcess \_

39 B B.1: CryptLocker 7 Kovter 4 Locker 5 Reveton

41 C NtReadVirtualMemorydash , GetFileSizedash , FindResour ceexwdash , NtTerminateThreaddash , CreateDirectoryWdash , NtQueryAttributesFiledash CryptAcquireContextAdash , NtTerminateThreaddash , SetFi lepo inter Exda sh , CertOpenSystemStoreAdash , NtCreateMutantdash , RtlDecompressBufferdash CryptAcquireContextAdash , InternetCrackUrlWdash , LdrGetProcedureAddressdash , DnsQuery \ _Wdash , SetFilePointerExdash , NtOpenProcessdash NtDuplicateObjectdash , getaddrinfodash , NtReadVirtualMemorydash , VirtualFreeExdash , InternetOpenUrlWdash , SetFileAttributesWdash CryptAcquireContextAdash , InternetCrackUrlWdash , LdrGetProcedureAddressdash , DnsQuery \ _Wdash , SetFilePointerExdash , NtOpenProcessdash Process32NextWdash , NtGetContextThreaddash , CryptAcquireContextAdash , NtTerminateThreaddash , GetComputerNameAdash , MessageBoxTimeoutAdash CertOpenStoredash , SetWindowsHookExAdash , FindResour ceexwdash , CoInitializeSecuritydash , NtTerminateThreaddash , NtAllocateVirtualMemorydash GetVolumePathNamesForVolumeNameWdash , SetFilePointerExdash , CryptAcquireContextAdash , LdrGetProcedureAddressdash , DnsQuery \ _Wdash , 31

42 SetFileAttributesWdash CryptAcquireContextAdash , NtTerminateThreaddash , SetFilePointerExdash , CertOpenSystemStoreAdash , NtCreateMutantdash , RtlDecompressBufferdash GetVolumePathNamesForVolumeNameWdash , SetFilePointerExdash , CryptAcquireContextAdash , DnsQuery \ _Wdash , ShellExecuteExWdash , SetFileAttributesWdash CreateToolhelp32Snapshotdash , CryptAcquireContextAdash , FindResourceWdash , LdrGetProcedureAddressdash , DnsQuery \ _Wdash , SetFi lepo inter Exda sh SetFilePointerExdash , CryptAcquireContextAdash , NtDelayExecutiondash , ShellExecuteExWdash , InternetOpenUrlWdash , SetFileAttributesWdash CreateToolhelp32Snapshotdash , GetVolumePathNamesForVolumeNameWdash , NtReadVirtualMemorydash , CryptAcquireContextAdash , SetFileAttributesWdash , GetKeyStatedash CertOpenStoredash , CryptAcquireContextAdash , SetWindowsHookExAdash , NtTerminateThreaddash , FindResourceExWdash , NtAllocateVirtualMemorydash CryptAcquireContextAdash , InternetCrackUrlWdash , LdrGetProcedureAddressdash , DnsQuery \ _Wdash , SetFilePointerExdash , NtOpenProcessdash CryptAcquireContextAdash , SetWindowsHookExAdash , NtTerminateThreaddash , CoInitializeSecuritydash , FindResourceExWdash , NtAllocateVirtualMemorydash CryptAcquireContextAdash , RtlAddVectoredExceptionHandlerdash , NtSetContextThreaddash , VirtualFreeExdash , CertOpenSystemStoreAdash , NtCreateMutantdash CryptAcquireContextAdash , 32

43 InternetCrackUrlWdash , LdrGetProcedureAddressdash , DnsQuery \ _Wdash , SetFilePointerExdash , NtOpenProcessdash NtGetContextThreaddash , CryptAcquireContextAdash , LoadResourcedash , CoInitializeSecuritydash , InternetOpenUrlWdash , MessageBoxTimeoutAdash LdrUnloadDlldash , RtlAddVectoredExceptionHandlerdash , CreateServiceAdash , NtSetInformationFiledash , OpenSCManagerWdash , SetFileAttributesWdash NtGetContextThreaddash , CryptAcquireContextAdash , VirtualFreeExdash , InternetCloseHandledash , ShellExecu teexwdash , NtFreeVirtualMemorydash SetFilePointerExdash , CryptAcquireContextAdash , LdrGetProcedureAddressdash , DnsQuery \ _Wdash , SetFileAttributesWdash , NtOpenProcessdash NtReadVirtualMemorydash , CryptAcquireContextAdash , GetFileSizedash , CreateDirectoryWdash , NtAllocateVirtualMemorydash , N topenprocessdash LdrUnloadDlldash , InternetSetStatusCallbackdash , GetDiskFreeSpaceExWdash , LookupPrivilegeValueWdash , SetFilePointerExdash , LdrLoadDlldash CertOpenStoredash , SetWindowsHookExAdash , FindResour ceexwdash , CoInitializeSecuritydash , NtTerminateThreaddash , NtAllocateVirtualMemorydash SetFilePointerExdash , CryptAcquireContextAdash , LdrGetProcedureAddressdash , DnsQuery \ _Wdash , SetFileAttributesWdash , N topenprocessdash CreateToolhelp32Snapshotdash , GetVolumePathNamesForVolumeNameWdash , CryptAcquireContextAdash , ShellExecu teexwdash , 33

44 InternetOpenUrlWdash , SetFi lepo inter Exda sh GetShortPathNameWdash , VirtualFreeExdash , ShellExecuteExWdash , CryptAcquireContextAdash , SetFi lepo inter Exda sh

45 D FaceNet Adversarial Examples,

..,,,, , ( ) 3.,., 3.,., 500, 233.,, 3,,.,, i

..,,,, , ( ) 3.,., 3.,., 500, 233.,, 3,,.,, i 25 Feature Selection for Prediction of Stock Price Time Series 1140357 2014 2 28 ..,,,,. 2013 1 1 12 31, ( ) 3.,., 3.,., 500, 233.,, 3,,.,, i Abstract Feature Selection for Prediction of Stock Price Time