CAJ | 학술논문

恶意软件通过隐藏自身行为来逃避安全监控程序的检测.当前的安全监控程序通常位于操作系统内部,难以有效检测恶意软件,特别是内核级恶意软件的隐藏行为.针对现有方法中存在的不足,提出了基于虚拟机监控器(virtual machine monitor,简称VMM)的操作系统隐藏对象关联检测方法,并设计和实现了相应的检测系统vDetector.采用隐式和显式相结合的方式建立操作系统对象的多个视图,通过对比多视图间的差异性来识别隐藏对象,支持对进程、文件及网络连接这3种隐藏对象的检测,并基于操作系统语义建立隐藏对象间的关联关系以识别完整攻击路径.在 KVM 虚拟化平台上实现了 vDetector 的系统原型,并通过实验评测 vDetector 的有效性和性能.结果表明, vDetector能够有效检测出客户操作系统(guest OS)中的隐藏对象,且性能开销在合理范围内.
악의연건통과은장자신행위래도피안전감공정서적검측.당전적안전감공정서통상위우조작계통내부,난이유효검측악의연건,특별시내핵급악의연건적은장행위.침대현유방법중존재적불족,제출료기우허의궤감공기(virtual machine monitor,간칭VMM)적조작계통은장대상관련검측방법,병설계화실현료상응적검측계통vDetector.채용은식화현식상결합적방식건립조작계통대상적다개시도,통과대비다시도간적차이성래식별은장대상,지지대진정、문건급망락련접저3충은장대상적검측,병기우조작계통어의건립은장대상간적관련관계이식별완정공격로경.재 KVM 허의화평태상실현료 vDetector 적계통원형,병통과실험평측 vDetector 적유효성화성능.결과표명, vDetector능구유효검측출객호조작계통(guest OS)중적은장대상,차성능개소재합리범위내.
To evade the detection of security monitoring systems, malware often hides its behavior. Current monitoring systems usually reside in the operating system (OS). Thus, it is hard to detect the existence of malware, especially the kernel rootkits. In this paper, a hidden OS objects detection and correlation approach based on VMM (virtual machine monitor) is proposed, and the corresponding detection system, vDetector, is designed and implemented. Both implicit and explicit information are used to create multiple views of OS objects, and a multi-view comparison mechanism are designed to identify three kinds of hidden OS objects:process, file and connections. The relations among hidden objects are established based on OS semantic information to trace the complete attack path. vDetector is implemented based on KVM virtualization platform and the effectiveness and performance overhead of vDetector are evaluated by comprehensive experiments. The results show that vDetector can successfully detect the existence of hidden OS objects with reasonable performance overhead.