نویسندگان
1 کارشناسی ارشد، دانشگاه آزاد اسلامی بروجرد
2 دانشیار، دانشگاه علم و صنعت ایران
چکیده
کلیدواژهها
عنوان مقاله [English]
نویسندگان [English]
In this article we propose a file analyzer based on sandbox in the client side. This analyzer environment is
used for safe execution of a suspicious application to find its behavior and determine if it is safe or not. This
sandbox can also be used for behavioral modeling of a malware by in hand execution for understanding
distractive and infecting pattern of malwares for creating disinfection and a cleaner method. The advantages
of proposed method is in reducing problems with malware detection specifically in detection of obfuscated
and metamorphic malwares that can’t be detected by signature and static base analysis methods. So this
contains the main goal of this article for providing platform of dynamic analysis. Proposed sandbox can
monitor and track incoming requests of an application in both user and kernel mode of operating system.
This article clusters incoming requests in 8 families with performing data mining on 21000 samples of
malwares and benign files and replying them with 5 policies y including logging, redirection, rejecting,
cheating and emulating of system resources. Our sandbox guarantees health of operation system during
execution and analysis of malwares. In addition this article discusses challenges on dynamic analysis and
analyzer environment and gives solutions for them. Most of the challenges focus on methods of detecting
and bypassing analyzer environments. At last, this article evaluates the proposed sandbox based on the
potentiality and capabilities of behavioral tracking and usage of system resources and compares it with some
top famous analyzers in the word.
کلیدواژهها [English]
)
