【作者】 黄康；

【导师】 王炜；

【作者基本信息】 南京大学 ， 计算机技术（专业学位）， 2019， 硕士

【摘要】 恶意软件的行为探测一直以来都是恶意软件检测的最核心的内容。通过检测恶意软件所有的行为模式,可以了解其工作流程,从而洞察恶意软件的内在逻辑。通常,发布的软件都会经过代码混淆,不容易直接通过静态分析探测出所有的行为逻辑。因此,对恶意软件进行动态分析就显得尤为重要。恶意软件动态分析系统的主要特点是方便快捷,且能够真实还原恶意软件在种种实际场景下的行为。在进行恶意软件动态分析之前,让恶意软件能够顺利地执行起来便成了恶意软件研究领域首要亟待解决的问题,配置网络环境,供应软件服务资源等一系列问题等待着研究者们去解决。本文关键的成果是针对恶意软件环境复现的问题,设计并实现了一个静态分析框架——Chipmunk,提供给软件安全分析者直观清晰的可视化静态分析结果,并获得本地运行配置文件;同时设计并实现了一个实验环境部署的上层系统——Conductor。该系统能够通过分析网络环境配置文件,方便快捷地构建出一个恶意软件运行的本地以及网络拓扑环境,并且能够借助高交互性代理,根据恶意软件的对外质询流量,指定网络拓扑中的组件,完成资源配给,在恶意软件的执行过程中,完善网络拓扑结构。本文的主要工作在于:一、恶意软件运行环境的需求提取。我们通过静态分析框架自动化分析恶意软件的静态层面的控制流与数据流,搭建初步可以运行的测试环境之后,设计了一款高交互性代理来监控恶意软件的逻辑和行为,通过对所有外发质询流量的截获与分析,知晓其执行过程中的实时所需外部资源,提供例如Web服务器,DNS,因特网等各种网络组件与网络服务,逐步地扩大和完善测试环境。二、恶意软件漏洞利用指纹检测。在工作一的基础上,将恶意软件后续一系列外发的流量视为该恶意软件进行特定漏洞利用的指纹,为了使得漏洞利用能够执行成功,从而观测到恶意软件的后续行为,我们需要检索已有的CVE列表,匹配相似指纹,在网络拓扑中添加并配置好具有该漏洞的系统的受害者主机。三、利用程序切片的方法,简化静态分析工作,依照控制流和数据流两个概念为线索,获得关键函数的触发路径和数据依赖。四、提供给用户统一的上层管理系统。为了能够实现在大规模的服务器集群上,任意节点或者任意节点上的虚拟机上面进行的资源配置或者网络拓扑的增删改,我们提供了一个上层的管理系统Conductor,该系统屏蔽底层的技术实现,兼顾不同实现技术的差异性,将整个配置流程标准化,透明化。用户只需要调用标准接口,指定机器和服务信息即可。本文的工作能够帮助恶意软件分析人员快速搭建起恶意软件的持续可运行的实验环境,让恶意软件能够在合适的本地以及网络环境中,充分暴露自己的恶意行为,减轻了分析人员的工作负担。更多还原

【Abstract】 Malware behavior detection has always been the core research issue of malware detection.By detecting all the behavior patterns of malware and understanding its workflow,we can understand the inherent logic of malware.Usually,the released software may have their code obfuscated,and it is not easy to detect all the behavior logic directly through static analysis.Therefore,the dynamic analysis of malware is particularly important.The main advantages of the malware dynamic analysis system are:convenient,fast,and can truly restore the behavior of malware in various actual scenarios.To dynamically analyze the malware,allowing malware to execute smoothly has become the most urgent problem in the field of malware research.A series of problems such as configuring the network environment and supplying software service resources are the major research issues in this field.The key result of this paper is to solve the problem of reproducing malware environment,and design and implement a static analysis framework-Chipmunk,which provides software security analysts with intuitive and clear visual static analysis results,and generates local running configuration files.Besides,we design and implement an upper layer system of experimental environment deployment-Conductor.The system can quickly and easily construct the local environment and the network topology in which malware runs by analyzing network environment configuration files.It can achieve resource allocation at specified components in the network topology according to the external interrogation traffic of malware by means of highly interactive proxy and improve the network topology during the execution of malware.The main work of this paper is:First,we extract the demand directly from the malware operating environment.After automating the analysis of the control flow and data flow of the static level of malware through a static analysis framework and setting up a preliminary test environment,we designed a highly interactive agent to monitor the logic and behavior of malware.Through the interception and analysis of all outgoing challenge traffic,we know that it is in the process of execution.The real-time external resources required to provide various network components and network services such as Web server,DNS,Internet,etc.,gradually expand and improve the test environment.Second,we use fingerprint based detection for malware exploitations.Based on the environment extraction,the subsequent outbound traffic of malware is regarded as the fingerprint of the malware for specific exploitation.In order to make the exploit successful,and observe the follow-up behavior of the malware,we need to retrieve the CVE lists,matching similar fingerprints,add and configure the victim host of the system with the vulnerability in the network topology.Third,by using the method of program slicing,we simplifying the static analysis work according to the two concepts of control flow and data flow as clues.We obtain Get trigger paths and data dependencies for key functions.Fourth,we provide the user with a unified upper management system.In order to realize the resource configuration or the addition or deletion of the network topology on the virtual machine of any node or any node on a fairly large-scale server cluster,we provide an upper management system:Conductor,which shields the underlying technology implementation.Taking into account the differences in different implementation technologies,the entire configuration process is standardized and transparent,and users only need to call standard interfaces to specify machine and service information.The work of this paper can help malware analysts quickly build a continuous and viable experimental environment for malware,allowing malware to fully expose its malicious behavior in a suitable local and network environment,reducing the workload of analysts.更多还原