紀要論文

APIコール順序情報によるマルウェアの攻撃目的推定の研究

Malware Attack Objective Evaluation Based on API Calls Sequence Information

jpn

24368083

https://doi.org/10.15002/00026413

法政大学大学院理工学研究科

法政大学大学院紀要. 理工学研究科編

64

1

5

2023-03-24

Version of Record

Cyber-attacks are increasing every year, and the scale of damage is also growing. Since malware is commonly used in cyber attacks, the number of malware detections is also on the rise. Since it is impossible to respond to malware by analyzing them one by one, many research efforts are being made to develop detection and classification methods that require as little manpower as possible. Malware analysis methods can be broadly classified into dynamic analysis and static analysis. In this study, we focus on dynamic analysis, which requires a relatively short analysis time and is suitable for processing a large number of malware compared to static analysis. We believe that if the purpose of an attack can be estimated using information on the names of API functions invoked by dynamic analysis, it can be used for damage assessment and recovery. In this study, we analyze the order information of API calls obtained from dynamic analysis to estimate the purpose of malware attacks. As a result, we show that the relationship between the order information of API calls and the attack objectives is characteristic.

Article