Fighting malware and spam

Anti-malware expert system

Kyu-beom Hwang, Deok-young Jung AhnLab

The EXPERT system is a useful approach for analysing malware or other kinds of software. We designed an anti-malware expert system using our compiled research results.

AMES (AhnLab anti-Malware Expert System) consists of automatic static/dynamic analysis systems, classification technology of malware and non-malware, and environment analysis. This system helps to minimize human error, or false positive detection.

Diverse approaches, like the technology of malware auto-analysis system and classification malware and static/dynamic analysis technology for malware, were tried by AV/AM researchers. Inference malware from function-signature and dectecting behaviour patterns of malware are some of the purposes of AMES. If a sample is a malware, then AVES generates a detecting signature automatically.

Of course, it is difficult to predict all 'malicious' codes automatically, but we get useful results using our malware knowledge database. We think that the core technology is able to judge whether a code is a malware or not, and will be able classify them accordingly. In the traditional virus case, if a virus infected program 'A+V' consists of a safe program 'A' and virus function 'V', and almost all of the functions of 'A+V' are not virus functions, but all functions of 'A+V' are same as 'A', then our AMES will treat it as a virus.

The knowledge database has much information about analysts' studied information, extraction functions and behavioural information on collected virus and non-virus. To make a knowledge database, we have designed three categories. First is a function-based static analysis environment. The second category is a virtual machine based dynamic analysis system, while the last one is a human-based active analysis environment. We designed a generic unpacking method for runtime-packed samples on virtual machines and plug-in runtime debuggers.

The objective of AMES is to help analysts evaluate samples and judge malware as variant or non-malware. AMES uses classification technology and function similarity in collaborative analysis technology. We will make the system more concrete by using various dynamic analysis technology researches on a virtualization environment.

Poll

VB2009