{"links":{},"id":187224,"metadata":{"_oai":{"id":"oai:ipsj.ixsq.nii.ac.jp:00187224","sets":["6164:6165:6462:9463"]},"path":["9463"],"owner":"11","recid":"187224","title":["実機を用いたマルウェア動的解析システムの環境復元ソフトウェアによる容易な構築方法"],"pubdate":{"attribute_name":"公開日","attribute_value":"2017-10-16"},"_buckets":{"deposit":"3486ab51-a6bc-43a1-8c0c-278c7ba34d57"},"_deposit":{"id":"187224","pid":{"type":"depid","value":"187224","revision_id":0},"owners":[11],"status":"published","created_by":11},"item_title":"実機を用いたマルウェア動的解析システムの環境復元ソフトウェアによる容易な構築方法","author_link":["422717","422722","422724","422715","422718","422719","422723","422716","422720","422721"],"item_titles":{"attribute_name":"タイトル","attribute_value_mlt":[{"subitem_title":"実機を用いたマルウェア動的解析システムの環境復元ソフトウェアによる容易な構築方法"},{"subitem_title":"Easy Implementation of Bare-Metal Sandbox with Commercial System Recovery Software","subitem_title_language":"en"}]},"item_keyword":{"attribute_name":"キーワード","attribute_value_mlt":[{"subitem_subject":"環境復元ソフトウェア，マルウェア動的解析，解析環境検知，実機による動的解析","subitem_subject_scheme":"Other"}]},"item_type_id":"18","publish_date":"2017-10-16","item_language":{"attribute_name":"言語","attribute_value_mlt":[{"subitem_language":"jpn"}]},"item_18_text_3":{"attribute_name":"著者所属","attribute_value_mlt":[{"subitem_text_value":"横浜国立大学"},{"subitem_text_value":"横浜国立大学"},{"subitem_text_value":"横浜国立大学"},{"subitem_text_value":"横浜国立大学大学院環境情報研究院/先端科学高等研究院"},{"subitem_text_value":"横浜国立大学大学院環境情報研究院/先端科学高等研究院"}]},"item_18_text_4":{"attribute_name":"著者所属(英)","attribute_value_mlt":[{"subitem_text_value":"Yokohama National University","subitem_text_language":"en"},{"subitem_text_value":"Yokohama National University","subitem_text_language":"en"},{"subitem_text_value":"Yokohama National University","subitem_text_language":"en"},{"subitem_text_value":"Graduate School of Environment and Information Sciences, Yokohama National University/Institute of Advanced Sciences, Yokohama National University","subitem_text_language":"en"},{"subitem_text_value":"Graduate School of Environment and Information Sciences, Yokohama National University/Institute of Advanced Sciences, Yokohama National University","subitem_text_language":"en"}]},"item_publisher":{"attribute_name":"出版者","attribute_value_mlt":[{"subitem_publisher":"情報処理学会","subitem_publisher_language":"ja"}]},"publish_status":"0","weko_shared_id":-1,"item_file_price":{"attribute_name":"Billing file","attribute_type":"file","attribute_value_mlt":[{"url":{"url":"https://ipsj.ixsq.nii.ac.jp/record/187224/files/IPSJCSS2017049.pdf","label":"IPSJCSS2017049.pdf"},"date":[{"dateType":"Available","dateValue":"2019-10-16"}],"format":"application/pdf","billing":["billing_file"],"filename":"IPSJCSS2017049.pdf","filesize":[{"value":"719.5 kB"}],"mimetype":"application/pdf","priceinfo":[{"tax":["include_tax"],"price":"660","billingrole":"5"},{"tax":["include_tax"],"price":"330","billingrole":"6"},{"tax":["include_tax"],"price":"0","billingrole":"30"},{"tax":["include_tax"],"price":"0","billingrole":"46"},{"tax":["include_tax"],"price":"0","billingrole":"44"}],"accessrole":"open_date","version_id":"f87c05b1-3ad7-4d20-a601-48ce6e470e8a","displaytype":"detail","licensetype":"license_note","license_note":"Copyright (c) 2017 by the Information Processing Society of Japan"}]},"item_18_creator_5":{"attribute_name":"著者名","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"上野, 航"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"石井, 攻"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"田辺, 瑠偉"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"吉岡, 克成"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"松本, 勉"}],"nameIdentifiers":[{}]}]},"item_18_creator_6":{"attribute_name":"著者名(英)","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"Wataru, Ueno","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Kou, Ishii","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Rui, Tanabe","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Katsunari, Yoshioka","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Tsutomu, Matsumoto","creatorNameLang":"en"}],"nameIdentifiers":[{}]}]},"item_18_relation_9":{"attribute_name":"書誌レコードID","attribute_value_mlt":[{"subitem_relation_type_id":{"subitem_relation_type_select":"NCID","subitem_relation_type_id_text":"ISSN　1882-0840"}}]},"item_resource_type":{"attribute_name":"資源タイプ","attribute_value_mlt":[{"resourceuri":"http://purl.org/coar/resource_type/c_5794","resourcetype":"conference paper"}]},"item_18_description_7":{"attribute_name":"論文抄録","attribute_value_mlt":[{"subitem_description":"マルウェアの動的解析環境は仮想マシンやエミュレータを用いるものが多く，これらの環境を検知し動的解析を回避するマルウェアが報告されている．対策技術として実機を用いる手法が提案されているが，OSより低いレイヤで解析環境を管理する必要があるため技術的に高度であり，実装コストが高い．そこで本研究では，実機を用いたマルウェア動的解析システムを環境復元ソフトウェアにより容易に構築する方法を提案する．評価実験では，仮想環境を検知して挙動を変えることが確認されている18検体の実マルウェアを用いて提案手法の有効性を検証する．また，提案手法により構築した解析環境を検知するマルウェアについて考察する．","subitem_description_type":"Other"}]},"item_18_description_8":{"attribute_name":"論文抄録(英)","attribute_value_mlt":[{"subitem_description":"For a long while, malware sandboxes have been mainly implemented with virtual machine or emulator for ease of system recovery and management. However, series of studies have revealed that more and more malware authors are trying to evade these virtual sandboxes. Although bare-metal systems have been proposed to overcome these evasion, their implementation is more complicated and costly than virtual ones as they require physical disk management below OS layer. In this paper, we propose an easy implementation of bare-metal malware sandbox using commercial system recovery software. At the experiment, we evaluate the proposed system with 18 malware samples known to evade virtual sandboxes. In addition, we discuss the possibility of evasion against our sandbox to prepare for future attacks.","subitem_description_type":"Other"}]},"item_18_biblio_info_10":{"attribute_name":"書誌情報","attribute_value_mlt":[{"bibliographic_titles":[{"bibliographic_title":"コンピュータセキュリティシンポジウム2017論文集"}],"bibliographicIssueDates":{"bibliographicIssueDate":"2017-10-16","bibliographicIssueDateType":"Issued"},"bibliographicIssueNumber":"2","bibliographicVolumeNumber":"2017"}]},"relation_version_is_last":true,"weko_creator_id":"11"},"created":"2025-01-19T00:53:54.765471+00:00","updated":"2025-01-20T02:23:01.978707+00:00"}