{"updated":"2025-01-21T10:32:43.376032+00:00","metadata":{"_oai":{"id":"oai:ipsj.ixsq.nii.ac.jp:00103101","sets":["581:7397:7668"]},"path":["7668"],"owner":"11","recid":"103101","title":["マルウェア観測のための仮想計算機モニタを用いたシステムコールトレース手法"],"pubdate":{"attribute_name":"公開日","attribute_value":"2014-09-15"},"_buckets":{"deposit":"d84936b2-6c4d-49f6-991a-fa05d1e0e10e"},"_deposit":{"id":"103101","pid":{"type":"depid","value":"103101","revision_id":0},"owners":[11],"status":"published","created_by":11},"item_title":"マルウェア観測のための仮想計算機モニタを用いたシステムコールトレース手法","author_link":["0","0"],"item_titles":{"attribute_name":"タイトル","attribute_value_mlt":[{"subitem_title":"マルウェア観測のための仮想計算機モニタを用いたシステムコールトレース手法"},{"subitem_title":"System Call Tracer based on Virtual Machine Monitor for Malware Analysis","subitem_title_language":"en"}]},"item_keyword":{"attribute_name":"キーワード","attribute_value_mlt":[{"subitem_subject":"[特集：新しいリスクに対応するコンピュータセキュリティ技術(特選論文)] マルウェア，動的解析，仮想計算機モニタ，システムコールトレース","subitem_subject_scheme":"Other"}]},"item_type_id":"2","publish_date":"2014-09-15","item_2_text_3":{"attribute_name":"著者所属","attribute_value_mlt":[{"subitem_text_value":"立命館大学"},{"subitem_text_value":"立命館大学"},{"subitem_text_value":"名古屋工業大学"},{"subitem_text_value":"立命館大学"}]},"item_2_text_4":{"attribute_name":"著者所属(英)","attribute_value_mlt":[{"subitem_text_value":"Ritsumeikan University","subitem_text_language":"en"},{"subitem_text_value":"Ritsumeikan University","subitem_text_language":"en"},{"subitem_text_value":"Nagoya Institute of Technology","subitem_text_language":"en"},{"subitem_text_value":"Ritsumeikan University","subitem_text_language":"en"}]},"item_language":{"attribute_name":"言語","attribute_value_mlt":[{"subitem_language":"jpn"}]},"publish_status":"0","weko_shared_id":-1,"item_file_price":{"attribute_name":"Billing file","attribute_type":"file","attribute_value_mlt":[{"url":{"url":"https://ipsj.ixsq.nii.ac.jp/record/103101/files/IPSJ-JNL5509011.pdf"},"date":[{"dateType":"Available","dateValue":"2016-09-15"}],"format":"application/pdf","billing":["billing_file"],"filename":"IPSJ-JNL5509011.pdf","filesize":[{"value":"1.3 MB"}],"mimetype":"application/pdf","priceinfo":[{"tax":["include_tax"],"price":"660","billingrole":"5"},{"tax":["include_tax"],"price":"330","billingrole":"6"},{"tax":["include_tax"],"price":"0","billingrole":"8"},{"tax":["include_tax"],"price":"0","billingrole":"44"}],"accessrole":"open_date","version_id":"40ddcba4-a488-4e49-bdf8-409c520f8601","displaytype":"detail","licensetype":"license_note","license_note":"Copyright (c) 2014 by the Information Processing Society of Japan"}]},"item_2_creator_5":{"attribute_name":"著者名","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"大月, 勇人"},{"creatorName":"瀧本, 栄二"},{"creatorName":"齋藤, 彰一"},{"creatorName":"毛利, 公一"}],"nameIdentifiers":[{}]}]},"item_2_creator_6":{"attribute_name":"著者名(英)","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"Yuto, Otsuki","creatorNameLang":"en"},{"creatorName":"Eiji, Takimoto","creatorNameLang":"en"},{"creatorName":"Shoichi, Saito","creatorNameLang":"en"},{"creatorName":"Koichi, Mouri","creatorNameLang":"en"}],"nameIdentifiers":[{}]}]},"item_2_source_id_9":{"attribute_name":"書誌レコードID","attribute_value_mlt":[{"subitem_source_identifier":"AN00116647","subitem_source_identifier_type":"NCID"}]},"item_resource_type":{"attribute_name":"資源タイプ","attribute_value_mlt":[{"resourceuri":"http://purl.org/coar/resource_type/c_6501","resourcetype":"journal article"}]},"item_2_source_id_11":{"attribute_name":"ISSN","attribute_value_mlt":[{"subitem_source_identifier":"1882-7764","subitem_source_identifier_type":"ISSN"}]},"item_2_description_7":{"attribute_name":"論文抄録","attribute_value_mlt":[{"subitem_description":"マルウェア対策には，マルウェアの挙動を調査する必要がある．しかし，次々に新種のマルウェアが出現しているため，個々のマルウェアの調査に時間を費やすことはできない．このような場合，実際にマルウェアを動作させて挙動を調査する動的解析が有効である．従来の解析システムは，処理速度が十分でなかったり，アンチデバッグ機能により解析していることをマルウェアに検出されるなどの課題を有していた．そこで，我々は，それらの課題を解決すべく動的解析システムAlkanetを開発した．Alkanetは，仮想計算機モニタBitVisorをベースとしている．対象とするオペレーティングシステムはWindows XPとし，Windowsの最小の実行単位であるスレッドを単位としてシステムコールをトレースする機能を実現している．また，トレースログをIEEE1394を通じてリアルタイムに転送する機能を有し，トレースログを即座に別のコンピュータ上で処理することが可能である．本論文では，Alkanetの設計と実装について述べた後，Alkanetが，他の動的解析システムと比べて十分な処理速度で解析可能であること，典型的なアンチデバッグ機能に対して高い耐性を持つことなどを示す．","subitem_description_type":"Other"}]},"item_2_description_8":{"attribute_name":"論文抄録(英)","attribute_value_mlt":[{"subitem_description":"Recently, malware has become a major security threat to computers. Responding to threats from malware requires malware analysis and understanding malware behavior. However, malware analysts cannot spend the time to analyze each instance of malware. The method is to execute the malware and observe its behavior. The major dynamic analysis systems often cannot analyze malware quickly. In addition, recent malware detects the systems by anti-debugging techniques. To solve these problems, We are developing Alkanet, a malware analyzer that uses a virtual machine monitor based on BitVisor. Alkanet executes malware on Windows XP, and traces system calls invoked by threads. Therefore, the system can analyze malware that infects other running processes. Also, the system call trace logs are obtained in real time via a IEEE 1394 interface. In this paper, we describe the design and implementation of Alkanet. We confirmed that Alkanet run faster than other dynamic analysis systems. We also confirmed that most of anti-debugging techniques cannot detect Alkanet.","subitem_description_type":"Other"}]},"item_2_biblio_info_10":{"attribute_name":"書誌情報","attribute_value_mlt":[{"bibliographicPageEnd":"2046","bibliographic_titles":[{"bibliographic_title":"情報処理学会論文誌"}],"bibliographicPageStart":"2034","bibliographicIssueDates":{"bibliographicIssueDate":"2014-09-15","bibliographicIssueDateType":"Issued"},"bibliographicIssueNumber":"9","bibliographicVolumeNumber":"55"}]},"relation_version_is_last":true,"weko_creator_id":"11"},"created":"2025-01-18T23:48:11.282577+00:00","id":103101,"links":{}}