Proposta de arquitetura e protocolo para a geração automática de assinaturas de malwares

• Autor(a) principal: Souza, Gustavo André Arrabal de [UNESP]
• Data de Publicação: 2012
• Tipo de documento: Trabalho de conclusão de curso
• Idioma: por
• Título da fonte: Repositório Institucional da UNESP
• Texto Completo: http://hdl.handle.net/11449/121419
• topic: Serviços da Web; Engenharia de software; ActionScript (Linguagem de programação de computador); HTML (Linguagem de marcação de documento); Web services

Given the exponential growth in the spread of the virus world wide web (Internet) and its increasing complexity, it is necessary to adopt more complex systems for the extraction of malware finger-prints (malware fingerprints - malicious software; is the name given to extracting unique information leading to identification of the virus, equivalent to humans, the fingerprint). The architecture and protocol proposed here aim to achieve more efficient fingerprints, using techniques that make a single fingerprint enough to compromise an entire group of viruses. This efficiency is given by the use of a hybrid approach of extracting fingerprints, taking into account the analysis of the code and the behavior of the sample, so called viruses. The main targets of this proposed system are Polymorphics and Metamorphics Malwares, given the difficulty in creating fingerprints that identify an entire family from these viruses. This difficulty is created by the use of techniques that have as their main objective compromise analysis by experts. The parameters chosen for the behavioral analysis are: File System; Records Windows; RAM Dump and API calls. As for the analysis of the code, the objective is to create, in binary virus, divisions in blocks, where it is possible to extract hashes. This technique considers the instruction there and its neighborhood, characterized as being accurate. In short, with this information is intended to predict and draw a profile of action of the virus and then create a fingerprint based on the degree of kinship between them (threshold), whose goal is to increase the ability to detect viruses that do not make part of the same family