| Abstract [eng] |
As technology advances, so does the malware created by bad actors. Malware often employs anti-analysis techniques, which traditional (non-Virtual Machine Introspection (VMI) dynamic analysis methods are susceptible to. Therefore, there is a need to improve malware research methods by leveraging more advanced technologies. The aim of this work is to improve the collection of dynamic malicious code behavior using VMI technique. The analytical part of this work involved the analysis of scientific articles related to the topic and other scientific literature. The comparative analysis of the analytical part included a comparison of “Cuckoo” and “Drakvuf-VMI” technologies, which resulted in identifying the advantages of VMI technique. The method of composing the AWSCTD dataset was examined, shortcomings were identified, and improvements were proposed. In the practical part, improvements in dynamic malicious code behavior collection were implemented, resulting in the creation of a new tool called “Drak Management” using “Python” and “SQLite” technologies, which automates processes, facilitates the work of the researcher, and effectively collects and processes data. An empirical study, which analyzed performance and data generation, showed that using VMI technique, dynamic malicious code behavior collection becomes 4-5 times more efficient, and the number of system calls increases approximately twofold, thus enriching the AWSCTD dataset. The work consists of 11 parts: introduction, analysis of dynamic malicious code behavior collection methods, analysis of VMI technique, analysis and comparison of “Cuckoo” and “Drakvuf-VMI” tools, analysis of system call collection and AWSCTD dataset creation methods, proposal of the improvement model, implementation of dynamic malicious code behavior collection improvement and realization of the new “Drak Management” tool, empirical studies of the improved VMI method, conclusions, list of bibliographic references, and appendixes. The scope of the work is 75 p. of text, 42 illustrations, 17 tables, 49 bibliographic entries & 8 appendixes. |
