Search

Search Results

• DEVELOPMENT OF AUTOMATED MALWARE DETECTION SYSTEM

  L.К. Babenko, А.S. Kirillov

  153-167

  2021-10-05

  Abstract ▼

  When research in the field of malware detection, the authors focus exclusively on detection methods, ignoring how these methods could practically be implemented. On the other hand, there are works that reveal some technical details of the implementation or optimization of the process of analyzing the malware sample and collecting data on its work. However, it is necessary to com-bine the results of the concepts of experimental systems and the implementation possibilities that are available. The purpose of the work is description of the implementation of an automated mal-ware detection system based on the method proposed earlier by the authors, thus supplementing the results of previous studies and putting into practice the proposed method for detecting and clustering malware. As a result, the technical requirements for the developed system for detecting malware is described, due to the previously proposed method of detection and clustering. A com-parison of existing behavioral analysis tools was made, Сuckoo Sandbox was chosen as the most suitable one, its main advantage is the open source code, which made it possible to refine both its client part and server part. In particular, the list of controlled system functions has been expand-ed, the source module of the call has been determined, and the call context has been determined. Also, based on the Сuckoo Sandbox, an extension has been developed that implements the method proposed by the authors. The article also reveals the possibility of porting the described system to work with samples of malware developed for various platforms. In particular, it is shown that the proposed methods can be adapted to platforms such as .NET or Android, while the improvements are technical, not fundamental. From a practical point of view, the system is a software package for a security specialist and allows for the rapid detection of previously unknown threats and, at the same time, through clustering, to identify a specific threat in order to implement the most ap-propriate protection measures against this threat. In the proposed form, it can be used as part of the enterprise infrastructure to ensure anti-virus security