Method and apparatus for analyzing malicious code

1. A method of generating a representative graph for analyzing a function of a malicious code, the method comprising:

obtaining a source code from a pre-stored malicious file;

generating, by analyzing the source code, a first graph in which each of nodes is formed of a portion of the source code;

analyzing a dependency relationship between parameters by analyzing the nodes of the first graph;

generating second graphs indicating the analyzed dependency relationship between the parameters;

clustering the second graphs based on a degree of similarity; and

generating the representative graphs representing functions of clusters of the clustered second graphs,

wherein

the representative graphs representing functions of each clusters are generated based on adding the second graphs existing in each of the clusters.

2. The method of claim 1 , wherein

the first graph is a control flow graph (CFG), in which a basic block is formed by analyzing an abstract syntax tree, after the abstract syntax tree is generated by parsing the source code,

the parameters are application programming interface (API) parameters, and

the second graphs are API dependency graphs (ADGs) indicating a dependency relationship between the API parameters.

3. The method of claim 1 , further comprising

storing the representative graphs and generating a database (DB).

4. The method of claim 1 , wherein

the generating of the representative graphs comprises

generating the representative graphs by connecting only nodes having an appearance frequency exceeding a threshold value by adding each second graph.

5. The method of claim 1 , wherein

the clustering of the second graphs comprises

using a K-means clustering method.

6. A method of analyzing a function of a malicious code, the method comprising:

obtaining a source code of a malicious file which is an object of analysis;

generating, by analyzing the source code, a first graph in which each of nodes is formed of a portion of the source code;

analyzing a dependency relationship between parameters by analyzing the nodes of the first graph;

generating second graphs indicating the analyzed dependency relationship between the parameters; and

analyzing the function of the malicious code by comparing a degree of similarity between each of pre-stored representative graphs and the generated second graphs,

wherein

the comparing of the degree of similarity comprises using a ratio of an intersection to a union of nodes of the generated second graphs and nodes of each of the pre-stored representative graphs, as an index for determination of the degree of similarity.

7. The method of claim 6 , wherein

the first graph is a control flow graph (CFG), in which a basic block is formed by analyzing an abstract syntax tree, after the abstract syntax tree is generated by parsing the source code,

the parameters are application programming interface (API) parameters, and

the second graphs are API dependency graphs (ADGs) indicating a dependency relationship between the API parameters.

8. A method of analyzing an evolutionary relationship of a malicious code, the method comprising:

calculating a first degree of complexity of each of a plurality of malicious code binaries;

selecting a root binary that is initially generated, by using the calculated first degree of complexity; and

inferring an evolutionary order of the plurality of malicious code binaries, except for the root binary, based on the calculated first degree of complexity and a degree of distance between the plurality of malicious code binaries.

9. The method of claim 8 , wherein

the selecting of the root binary comprises

selecting, as the root binary, a malicious code binary having a lowest first degree of complexity from among malicious code binaries classified into the same family from among the plurality of malicious code binaries.

10. The method of claim 8 , wherein

the calculating of the first degree of complexity comprises

calculating the first degree of complexity by using a dynamic analysis and a static analysis, wherein

the dynamic analysis extracts the number of application programming interface (API) sequences called by each of the plurality of malicious code binaries, and

the static analysis extracts a second degree of complexity of each of the plurality of malicious code binaries, wherein the extracted second degree of complexity is determined as a sum of the number of nodes and the number of edges.

11. The method of claim 8 , wherein

the first degree of complexity is calculated according to equation 1:

First degree of complexity= w 1 s+w 2 d   [Equation 1]

(wherein w 1 , w 2 are arbitrary values and correspond to weight values, s is a second degree of complexity, and d is the number of application programming interface (API) sequences.)

12. The method of claim 11 , wherein,

when certain malicious code binaries are packed from among the plurality of malicious code binaries, w 1 is less than w 2 ,

when the certain malicious code binaries are anti-debugged, w 2 is less than w 1 , and

when the certain malicious code binaries are not packed and are not anti-debugged, w 1 is the same as w 2 .

13. The method of claim 8 , wherein

the degree of distance

is calculated according to equation 2:

D

⁡

(

p

i

,

p

j

)

=

1

-

❘

"\[LeftBracketingBar]"

p

i

⋂

p

j

❘

"\[RightBracketingBar]"

❘

"\[LeftBracketingBar]"

p

i

⋃

p

j

❘

"\[RightBracketingBar]"

[

Equation

⁢

2

]

(wherein p i and p j each denotes a certain malicious code binary, D(p i , p j ) denotes the degree of distance between p i and p j and

❘

"\[LeftBracketingBar]"

p

i

⋂

p

j

❘

"\[RightBracketingBar]"

❘

"\[LeftBracketingBar]"

p

i

⋃

p

j

❘

"\[RightBracketingBar]"

 is a degree of similarity between p i and p j ).

14. The method of claim 13 , wherein

the degree of similarity is calculated by using the number of application programming interface (API) sequences.

15. The method of claim 13 , wherein

the degree of similarity is calculated by using at least one of a Needleman-Wunsch algorithm, a Smith-Waterman algorithm, and a Hirschberg's algorithm.

16. The method of claim 8 , wherein

the inferring of the evolutionary order comprises:

identifying the root binary as; p 1

when it is assumed that a set of malicious code binaries, for which the evolutionary order is identified, from among the plurality of malicious code binaries, is, N and a set of malicious code binaries, for which the evolutionary order is not identified, from among the plurality of malicious code binaries, is N c , arranging the malicious code binaries of N c in an ascending order according to the first degree of complexity;

selecting a malicious code binary having a lowest first degree of complexity from the set N c as; p j

selecting a malicious code binary of the set, N the malicious code binary satisfying equation 3, as p i :

min{ D ( p j ,p i ): p i ∈N}   [Equation 3]

(wherein p i and p j each denotes a certain malicious code binary and D(p i , p j ) denotes the degree of distance between p i and p j );

identifying the selected p j , as an offspring of the selected p i ;

calculating D(p j , p k ) with respect to p k and the identified p j which are malicious code binaries having no offspring from the set N;

calculating D(a parent of p j , p k ) with respect to the parent of p j and p k ;

identifying p k as the parent of p j , when D(p j , p k ) is less than D(the parent of p j , p k ); and

identifying the evolutionary order by repeating the operations in the inferring of the evolutionary order, until all of the plurality of malicious code binaries are included in the set N.

17. The method of claim 16 , wherein

the inferring of the evolutionary order further comprises

deriving a graph according to the identified evolutionary order.

18. An apparatus for generating representative graphs for analyzing a function of a malicious code, the apparatus comprising:

a memory storing one or more instructions; and

one or more processors configured to execute the one or more instructions stored in the memory to:

obtain a source code from a pre-stored malicious file;

generate, by analyzing the source code, a first graph in which each of nodes is formed of a portion of the source code;

analyze a dependency relationship between parameters by analyzing the nodes of the first graph;

generate second graphs indicating the analyzed dependency relationship between the parameters;

cluster the second graphs based on a degree of similarity; and

generate the representative graphs representing functions of each of clusters of the clustered second graphs,

wherein

the representative graphs representing functions of each clusters are generated based on adding the second graphs existing in each of the clusters.

19. The apparatus of claim 18 , wherein

the first graph is a control flow graph (CFG), in which a basic block is formed by analyzing an abstract syntax tree, after the abstract syntax tree is generated by parsing the source code,

the parameters are application programming interface (API) parameters, and

the second graphs are API dependency graphs (ADGs) indicating a dependency relationship between the API parameters.

20. The apparatus of claim 18 , wherein

the representative graph is stored and a database (DB) is generated.

21. The apparatus of claim 18 , wherein

the representative graphs are generated by connecting only nodes having an appearance frequency exceeding a threshold value by adding each second graph.

22. The apparatus of claim 18 , wherein

the second graphs are clustered by using a K-means clustering method.

23. An apparatus for analyzing a function of a malicious code, the apparatus comprising:

a memory storing one or more instructions; and

one or more processors configured to execute the one or more instructions stored in the memory to:

obtain a source code of a malicious file which is an object of analysis;

generate, by analyzing the source code, a first graph in which each of nodes is formed of a portion of the source code;

analyze a dependency relationship between parameters by analyzing the nodes of the first graph;

generate second graphs indicating the analyzed dependency relationship between the parameters; and

analyze the function of the malicious code by comparing a degree of similarity between each of pre-stored representative graphs and the generated second graphs,

wherein

the degree of similarity is compared by using a ratio of an intersection to a union of nodes of the generated second graphs and nodes of each of the pre-stored representative graphs, as an index for determination of the degree of similarity.

24. The apparatus of claim 23 , wherein

the first graph is a control flow graph (CFG), in which a basic block is formed by analyzing an abstract syntax tree, after the abstract syntax tree is generated by parsing the source code,

the parameters are application programming interface (API) parameters, and

the second graphs are API dependency graphs (ADGs) indicating a dependency relationship between the API parameters.

25. An apparatus for analyzing an evolutionary relationship of a malicious code, the apparatus comprising:

a memory storing one or more instructions; and

one or more processors configured to execute the one or more instructions stored in the memory to:

calculate a first degree of complexity of each of a plurality of malicious code binaries;

select a root binary that is initially generated, by using the calculated first degree of complexity; and

infer an evolutionary order of the plurality of malicious code binaries, except for the root binary, based on the calculated first degree of complexity and a degree of distance between the plurality of malicious code binaries.

26. A recording medium having recorded thereon a program for executing the method of claim 1 on a computer.