Earticle

초록

영어

Malware is huge and growing at an exponential pace. Symantec observes 403 million new malware samples in 2011. Therefore, that efficiently and effectively analysis so many malware samples becomes a great challenge. Centralized systems cause problems of single point of failure as well as processing bottlenecks. Previous distributed systems are mainly applied for specific or simple malware. This paper presents SCMA, a new distributed malware analysis system which can analyze various malware, shares behavior fragments among its monitors efficiently, analyzes malware based on global behavior of malware and aggregates those analyses among monitors in a load-balance way. We implemented a proof-of-concept version of SCMA and performed experiments with 917 real-world malware samples; preliminary results from our evaluation confirm that SCMA has comparable performance with centralized system, but much better scalability, and is approximately consistent with the analysis of AV scanners.

목차

Abstract
 1 Introduction
 2 System Overview
  2.1 Architecture of SCMA
  2.2 Suspicious Program Discovering Daemon
  2.3 LOGLOG Address Set Representation
  2.4 Local Filter
  2.5 RENShare (RENdezvous-based Sharing Structure)
  2.6 Heuristic Fragments Correlation
  2.7 Malicious Program Decision Module
 3 Evaluation
  3.1 Comparing with Isolated Centralized System
  3.2 Comparing with Existing Distributed System
 4 Conclusion and Future Works
 Acknowledgements
 References

키워드

저자

• Huabiao Lu [ School of Computer, National University of Defense Technology ]
• Xiaofeng Wang [ School of Computer, National University of Defense Technology ]
• Jinshu Su [ School of Computer, National University of Defense Technology ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Grid and Distributed Computing

• 간기

  격월간

• pISSN

  2005-4262

• 수록기간

  2008~2016

• 십진분류

  KDC 505 DDC 605