원문정보
초록
영어
Malware is huge and growing at an exponential pace. Symantec observes 403 million new malware samples in 2011. Therefore, that efficiently and effectively analysis so many malware samples becomes a great challenge. Centralized systems cause problems of single point of failure as well as processing bottlenecks. Previous distributed systems are mainly applied for specific or simple malware. This paper presents SCMA, a new distributed malware analysis system which can analyze various malware, shares behavior fragments among its monitors efficiently, analyzes malware based on global behavior of malware and aggregates those analyses among monitors in a load-balance way. We implemented a proof-of-concept version of SCMA and performed experiments with 917 real-world malware samples; preliminary results from our evaluation confirm that SCMA has comparable performance with centralized system, but much better scalability, and is approximately consistent with the analysis of AV scanners.
목차
1 Introduction
2 System Overview
2.1 Architecture of SCMA
2.2 Suspicious Program Discovering Daemon
2.3 LOGLOG Address Set Representation
2.4 Local Filter
2.5 RENShare (RENdezvous-based Sharing Structure)
2.6 Heuristic Fragments Correlation
2.7 Malicious Program Decision Module
3 Evaluation
3.1 Comparing with Isolated Centralized System
3.2 Comparing with Existing Distributed System
4 Conclusion and Future Works
Acknowledgements
References