Anti-analysis detection system, and Anti-analysis detection method

Abstract

To provide an anti-analysis detection system capable of reducing operational costs and personnel dependency by supporting the detection and analysis of anti-analysis functions in an anti-analysis detection system, and an anti-analysis detection method.SOLUTION: The anti-analysis detection system includes a CPU and a main memory for storing data required for the CPU to execute processing. The CPU is configured to perform dynamic analysis of the malware being analyzed by executing a dynamic analysis program stored in the main memory, to create a Control Flow Graph (CFG) by merging the analysis results by running the CFG creation program, to detect branches related to avoidance functions in CFG by executing the branch-specific program, and to display each analysis result on a screen by running a screen drawing program.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an anti-analysis function detection system and an anti-analysis function detection method. [Background technology]

[0002] Dynamic analysis involves actually running malware, recording its behavior, and then analyzing it. This analysis method is widely used because it can be performed semi-automatically and allows for efficient analysis. However, there is malware that has features to evade dynamic analysis, such as stopping operation unless a specific language setting is used, and dealing with this has become an issue. Related technologies include Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-79500 A [Non-patent literature]

[0004] [Non-Patent Document 1] D. Kirat and G. Vigna: Malgene: Automatic extraction of malware analysis evasion signature, Proceedings of the 2015 ACM SIGSAC Conference on Computer and Communications Security (CCS 2015). [Non-patent document 2] M. Lindorfer, C. Kolbitsch and P. Milani Comparetti: Detecting Environment-Sensitive Malware, In: Sommer, R., Balzarotti, D., Maier, G. (eds) Recent Advances in Intrusion Detection. RAID 2011. Lecture Notes in Computer Science, vol 6961. Springer, Berlin, Heidelberg. Summary of the Invention [Problem to be solved by the invention]

[0005] The detection and analysis of malware evasion mechanisms are generally performed manually, which poses challenges in terms of operational costs and high dependency on individual personnel. Although several automated methods are known, they are currently incomplete, and are unable to adequately address unknown evasion mechanisms in particular.

[0006] Patent Document 1 describes a method for detecting malware by creating a control flow graph (CFG) from dynamic analysis logs of multiple environments and applying behavioral rules. This technology focuses on detecting malware, and does not detect or analyze its functions.

[0007] Non-Patent Document 1 describes a method for comparing dynamic analysis logs from two environments, identifying sections in the logs related to evasion functions based on differences in behavior, and extracting functions related to evasion functions as signatures. The method aims to automatically extract signatures using a database of malware with evasion functions, and does not support unknown evasion functions. Furthermore, since the method uses the existence of a single function as a signature, it cannot support complex evasion functions.

[0008] Non-Patent Document 2 is a method for comparing dynamic analysis logs from multiple environments to determine whether or not an evasion function is present. The purpose is to determine only whether or not an evasion function is present, and no detection or analysis of the function is performed. Furthermore, since the entire log is compared and the presence of an evasion function is determined from the magnitude of the difference, it is not possible to identify evasion behavior in the log.

[0009] An object of the present invention is to reduce operational costs and dependency on personnel by supporting the detection and analysis of anti-analysis functions in an anti-analysis function detection system. [Means for solving the problem]

[0010] An analysis evasion function detection system according to one aspect of the present invention is a malware analysis evasion function detection system connected to the Internet, characterized in that it comprises a plurality of dynamic analysis units that perform dynamic analysis of the malware, a control flow graph creation unit that combines the dynamic analysis results of a plurality of dynamic analyses performed by the dynamic analysis units to create a control flow graph related to the malware, a branch identification unit that detects the evasion function by identifying a branch related to the evasion function of the malware in the control flow graph using a predetermined signature, and a screen drawing unit that presents the evasion function of the malware to an analyst as support information. [Effects of the Invention]

[0011] According to one aspect of the present invention, an anti-analysis function detection system can support the detection and analysis of anti-analysis functions, thereby reducing operational costs and dependence on individual personnel. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 illustrates an example of the configuration of an analysis avoidance function detection system according to a first embodiment. [Figure 2] FIG. 10 is a diagram illustrating an example of a malware list. [Figure 3] FIG. 10 is a diagram illustrating an example of a dynamic analysis result list. [Figure 4]FIG. 10 is a diagram illustrating an example of a list of control flow graph analysis results. [Figure 5] FIG. 2 is a diagram showing an overall processing flow according to the first embodiment. [Figure 6] FIG. 10 is a diagram illustrating a processing flow of dynamic analysis. [Figure 7] FIG. 10 is a diagram illustrating a processing flow for creating a control flow graph. [Figure 8] FIG. 10 is a diagram showing a processing flow for identifying a branch using an avoidance function. [Figure 9] FIG. 10 is a diagram showing a processing flow of screen depiction. [Figure 10] FIG. 10 is a diagram illustrating an example of a depiction screen of the analysis avoidance function detection system. [Figure 11] FIG. 10 is a diagram illustrating a configuration example of an analysis avoidance function detection system according to a second embodiment. [Figure 12] FIG. 10 is a diagram illustrating an example of a signature list. [Figure 13] FIG. 1 illustrates an example of a control flow graph and a signature. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention should not be construed as being limited to the description of the embodiments shown below. Those skilled in the art will readily understand that the specific configuration can be changed without departing from the concept or spirit of the present invention.

[0014] In the configuration of the invention described below, the same or similar configurations or functions are denoted by the same reference numerals, and redundant explanations will be omitted.

[0015] In this specification, the terms "first," "second," "third," etc. are used to identify components and do not necessarily limit the number or order.

[0016] To facilitate understanding of the invention, the position, size, shape, range, etc. of each component shown in the drawings etc. may not represent the actual position, size, shape, range, etc. Therefore, the present invention is not limited to the position, size, shape, range, etc. disclosed in the drawings etc. [Example]

[0017] In Example 1, we will show the processing of a malware analysis support system that supports the detection and analysis of analysis evasion functions by merging dynamic analysis logs from multiple environments to create a control flow graph, using signatures related to graph patterns to detect branches related to evasion functions, and outputting relevant parts of the log and related information, thereby reducing operational costs and personal dependence.

[0018] FIG. 1 is a diagram illustrating an example of the configuration of an anti-analysis function detection system according to a first embodiment of the present invention.

[0019] In the analysis avoidance function detection system 101 according to the first embodiment, a user terminal 117 operated by a user is connected to the Internet 119 via a network 118.

[0020] The analysis evasion detection system 101 is a computer equipped with a CPU (Central Processing Unit) 103, a main memory 104 for storing data necessary for the CPU 103 to execute processing, a storage device 105 such as a hard disk or flash memory with the capacity to store large amounts of data, an IF (interface) 102 for communicating with other devices, an input / output device 106 for inputting and outputting data such as a keyboard or display, and a communication path 107 connecting these devices. Note that the communication path 107 is, for example, an information transmission medium such as a bus or cable.

[0021] The CPU 103 executes a dynamic analysis program 108 stored in the main memory 104 to perform dynamic analysis of the malware being analyzed, executes a CFG (Control Flow Graph) creation program 109 to merge the analysis results and create a CFG, executes a branch identification program 110 to detect branches related to evasion functions in the CFG, and executes a screen drawing program 111 to present each analysis result on the screen.

[0022] The storage device 105 stores a malware list 112 that manages malware information, a dynamic analysis result storage area 113 that stores the dynamic analysis results of malware and the created CFG, a dynamic analysis result list 114 that manages each analysis result and CFG of malware, a CFG analysis result list 115 that manages the analysis results of CFG, and a signature list 116 that manages the signatures of evasion functions.

[0023] The above programs and data may be stored in advance in memory 104 or storage device 105, or may be installed (loaded) when needed from input / output device 106 or from another device via IF 102.

[0024] The configuration of the malware analysis support system described in FIG. 1 is an example and is not limited to this.

[0025] FIG. 2 is a diagram showing an example of the malware list 112. As shown in FIG.

[0026] As shown in FIG. 2, the malware list 112 includes, for example, a malware ID 201, a registration date and time 202, a file name 203, and a hash value 204.

[0027] The malware ID 201 is a field for storing identification information for uniquely identifying malware to be analyzed. In the malware ID 201 of the first embodiment, a number is stored as the identification information.

[0028] The registration date and time 202 indicates the date and time when the malware was registered in the system. For example, the malware corresponding to the entry with the malware ID 201 of "0" indicates that it was registered at 10:00:00 on January 1, 2023. The present invention is not limited to the data format of the time stored in the registration date and time 202. Any data format that allows time to be determined, such as Unixtime, may be used.

[0029] The file name 203 is a field for storing the file name of the malware to be analyzed. For example, the file name of the malware corresponding to the entry where the malware ID 201 is "0" is "example.exe".

[0030] The hash value 204 is a field for storing the hash value of the malware to be analyzed. For example, the hash value of the malware corresponding to the entry where the malware ID 201 is "0" is "44D88612FEA8A8F36DE82E1278ABB02F."

[0031] The malware list described in FIG. 2 is an example and is not limited to this.

[0032] FIG. 12 is a diagram showing an example of a signature list.

[0033] 12, the signature list 116 includes, for example, a signature ID 1201, a registration date and time 1202, and a signature name 1203. Note that the signature list described in FIG. 12 is an example and is not limited to this.

[0034] FIG. 3 is a diagram showing an example of the dynamic analysis result list 114. As shown in FIG.

[0035] As shown in FIG. 3, the dynamic analysis result list 114 includes, for example, a malware ID 301, an analysis date and time 302, a dynamic analysis result path 303, and a CFG path 304.

[0036] The malware ID 301 is a field for storing identification information for uniquely identifying malware to be analyzed. In the malware ID 301 of the first embodiment, a number is stored as the identification information.

[0037] The analysis date and time 302 indicates the date and time when the malware was analyzed by the system. For example, the malware corresponding to the entry with the malware ID 301 of "0" was analyzed at 10:00:00 on January 1, 2023. The present invention is not limited to the data format of the time stored in the analysis date and time 302. Any data format that allows time to be determined, such as Unixtime, may be used.

[0038] The dynamic analysis result path 303 indicates the path of the dynamic analysis result storage area 113 where the results of dynamic analysis of malware are stored. For example, this indicates that the results of dynamic analysis of malware with a malware ID 301 of "0" by dynamic analysis program A 108a are stored in " / dynamic_analysis / 0 / a / result.json", the results of dynamic analysis by dynamic analysis program B 108b are stored in " / dynamic_analysis / 0 / b / result.json", ..., and the results of dynamic analysis by dynamic analysis program X 108x are stored in " / dynamic_analysis / 0 / x / result.json".

[0039] The CFG path 304 indicates the path of the dynamic analysis result storage area 113 where the created CFG is stored. For example, this indicates that the CFG of malware whose malware ID 301 is "0" is stored in " / cfg / 0 / result.json." Note that the dynamic analysis result list described in FIG. 3 is just an example and is not limited to this.

[0040] FIG. 4 is a diagram showing an example of the CFG analysis result list 115. As shown in FIG.

[0041] As shown in FIG. 4, the CFG analysis result list 115 includes, for example, a malware ID 401, an analysis date and time 402, a function 403 related to the bypass function, and an bypassed environment 404.

[0042] The malware ID 401 is a field for storing identification information for uniquely identifying malware to be analyzed. In the malware ID 401 of the first embodiment, a number is stored as identification information.

[0043] The analysis date and time 402 indicates the date and time when the malware was analyzed by the system. For example, the malware corresponding to the entry with the malware ID 401 of "0" was analyzed at 12:00:00 on January 1, 2023. The present invention is not limited to the data format of the time stored in the analysis date and time 402. Any data format that allows time to be determined, such as Unixtime, may be used.

[0044] The evasion function-related function 403 is a field that stores the function related to the evasion function by analyzing the CFG using the signature list 116. For example, malware corresponding to an entry with a malware ID 401 of "0" indicates the possibility that the function "NtOpenKey,HKLM / System / ControlSet001 / Services / Disk / Enum" is involved in the evasion function. This function is identified by the branch identification program 110, which will be described later. Note that the CFG analysis result list described in FIG. 4 is an example and is not limited to this.

[0045] Next, the processing executed by the analysis prevention function detection system 101 will be described.

[0046] FIG. 5 is a flowchart illustrating an outline of the processing executed by the analysis avoidance function detection system 101 according to the first embodiment.

[0047] The anti-analysis function detection system 101 first performs dynamic analysis (step 501), which will be described in detail with reference to FIG.

[0048] Next, a CFG is created (step 502), the details of which will be explained with reference to FIG.

[0049] Finally, branches related to the avoidance function in the CFG are detected (step 503), which will be described in detail with reference to FIG.

[0050] The processing flow of the malware analysis support system described in FIG. 5 is an example, and is not limited to this.

[0051] FIG. 6 is a flowchart illustrating an example of dynamic analysis processing executed by the anti-analysis function detection system 101 according to the first embodiment.

[0052] When the dynamic analysis program 108 executed by the CPU 103 receives an execution instruction, it starts the process described below.

[0053] The dynamic analysis program 108 receives malware to be analyzed from the user (step 601).

[0054] Next, the dynamic analysis program 108 performs dynamic analysis of the malware received in step 601 (step 602). For example, the dynamic analysis program 108 actually runs the malware for a certain period of time to obtain information such as the malware's connection destinations, running processes, and generated files.

[0055] Next, the dynamic analysis program 108 stores the dynamic analysis results of the malware obtained in step 602 in the dynamic analysis result storage area 113 (step 603).

[0056] Next, the dynamic analysis program 108 records the storage path of the malware dynamic analysis results stored in step 603 in the dynamic analysis result path 303 of the dynamic analysis result list 114, and ends the process (step 604).

[0057] 6 is merely an example of the dynamic analysis process, and is not intended to be limiting. Furthermore, the results of dynamic analysis of malware may be obtained and recorded from a source other than the dynamic analysis program 108. For example, the results may be obtained from an external malware analysis system or malware analysis service.

[0058] FIG. 7 is a flowchart illustrating an example of a CFG creation process executed by the anti-analysis function detection system 101 according to the first embodiment.

[0059] When the CFG generation program 109 executed by the CPU 103 receives an execution instruction, it starts the processing described below.

[0060] The CFG generation program 109 acquires the dynamic analysis results from the dynamic analysis result list 114 (step 701).

[0061] Next, the CFG creation program 109 creates a CFG based on the dynamic analysis results obtained in step 701 (step 702).

[0062] For example, as shown in FIG. 13, directed graphs 1301 and 1302 are compared, with the functions in the dynamic analysis results of dynamic analysis program A 108a and dynamic analysis program B 108b as points and their call relationships as edges, and similar parts are identified and parts with large differences are represented as branches, thereby creating CFG 1303.

[0063] Next, the CFG generation program 109 stores the CFG obtained in step 702 in the dynamic analysis result storage area 113 (step 703).

[0064] Next, the CFG generation program 109 records the storage path of the CFG stored in step 703 in the CFG path 304 of the dynamic analysis result list 114, and ends the process (step 704).

[0065] Note that the CFG creation processing method described in FIG. 7 is an example and is not limited to this. For example, a CFG may be created from the binary code of malware using static analysis. Also, the CFG may be obtained and recorded from a source other than the CFG creation program 109. For example, the CFG may be obtained from an external CFG creation system or CFG creation service.

[0066] FIG. 8 is a flowchart illustrating an example of a branch identification process related to an avoidance function executed by the analysis avoidance function detection system 101 according to the first embodiment.

[0067] When the branch identification program 110 executed by the CPU 103 receives an execution instruction, it starts the process described below.

[0068] The branch identification program 110 acquires the CFG from the dynamic analysis result list 114 (step 801).

[0069] Next, the branch identification program 110 obtains a signature related to the bypass function from the signature list 116 (step 802).

[0070] Next, the branch identification program 110 compares the conditional branches resulting from the differences in the dynamic analysis program 108 in the CFG obtained in step 801 with the signature obtained in step 802 to detect branches that may be related to the avoidance function (step 803).

[0071] 13, a specific example of a signature is when the destination of a conditional branch in CFG 1303 obtained by merging directed graphs 1301 and 1302 created from the dynamic analysis results of dynamic analysis program A 108a and dynamic analysis program B 108b is short in the analysis results of dynamic analysis program A 108a but continues long in the analysis results of dynamic analysis program B 108b, there is a possibility that an avoidance action is manifested at this branch. Such a CFG pattern can be considered as a signature.

[0072] Additionally, signatures could be based on the presence of specific functions, such as a function that opens a system configuration file, which is used to verify whether the environment is for dynamic analysis, or on CFG patterns that combine multiple functions.

[0073] For example, the signature may be any one of a function, a control flow graph pattern, and a combination of a control flow graph pattern and a function.

[0074] Next, the branch identification program 110 records the function related to the branch detected in step 803 in the function related to the avoided function 403 in the CFG analysis result list 115, and records the dynamic analysis program 108 that may have been avoided in the avoided environment 404 in the CFG analysis result list 115, and terminates the processing (step 804).

[0075] 8 is an example, and is not intended to be limiting. For example, it is conceivable to create or obtain multiple CFGs (e.g., a CFG created using static analysis and a CFG created in step 702) in the CFG creation process, compare them, and analyze the differences to detect branches related to the bypass function.

[0076] It is also possible to add information about the characteristics of the evasion function to the signature, and when the evasion function is detected by the signature, record the information about the characteristics of the evasion function in the CFG analysis result list 115. In addition, after detecting a branch related to the evasion function, it is also possible to record the binary code of the malware corresponding to the branch in the CFG analysis result list 115.

[0077] The analysis evasion function detection system 101 executes a screen rendering process for displaying various information to the user, in addition to the process described in FIG.

[0078] FIG. 9 is a flowchart illustrating an example of a screen rendering process executed by the analysis avoidance function detection system 101 according to the first embodiment.

[0079] When the screen rendering program 111 executed by the CPU 103 receives an execution instruction, it starts the processing described below.

[0080] The screen drawing program 111 acquires information related to the malware to be drawn from the malware list 112 (step 901). Here, it is assumed that a list including entries each consisting of a malware ID 201 is acquired.

[0081] The screen rendering program 111 acquires information related to the malware to be rendered from the dynamic analysis result list 114 (step 902). Here, it is assumed that a list including entries each consisting of a malware ID 301 is acquired.

[0082] The screen rendering program 111 acquires information related to the malware to be rendered from the CFG analysis result list 115 (step 903). Here, it is assumed that a list including entries each consisting of a malware ID 401 is acquired.

[0083] The screen drawing program 111 draws the information about the malware to be drawn on the screen (step 904), and ends the process.

[0084] The method of depicting the screen described with reference to FIG. 9 is merely an example and is not limiting.

[0085] FIG. 10 is an example of an analysis evasion function detection system depiction screen generated by a program constituting the analysis evasion function detection system 101 of the first embodiment.

[0086] The screen in FIG. 10 includes a malware summary 1001 and an anti-analysis function detection result 1002 .

[0087] The malware summary 1001 is basic information about the malware to be depicted, including, for example, the malware ID, registration date and time, file name, hash value, analysis date, dynamic analysis result path, and CFG path.

[0088] The anti-analysis function detection result 1002 is the result of detecting an anti-analysis function of malware, and includes, for example, a malware ID, an analysis date and time, a function related to the anti-analysis function, and an environment where the anti-analysis function was performed.

[0089] As described above, by displaying malware with a focus on the results of anti-analysis feature detection, it is expected that analysts and other users will find it useful when analyzing malware.

[0090] Although the display screens based on the execution results of the programs according to the first embodiment have been illustrated, this is merely an example and is not limiting. For example, any information related to malware analysis may be displayed in any format.

[0091] While dynamic malware analysis is an efficient method for investigating malware functions, it can sometimes hide these functions due to evasion mechanisms, and the detection and analysis of evasion mechanisms is generally performed manually, resulting in high operational costs and high dependency on the individual. Additionally, while several automated methods are known, they are currently incomplete, and there are particular issues with them not being able to adequately handle unknown evasion mechanisms.

[0092] According to the first embodiment, the anti-analysis function detection system 101 creates a control flow graph by merging dynamic analysis logs from multiple environments, detects branches related to evasion functions using signatures related to patterns in the graph, and outputs relevant parts of the log and related information, thereby supporting the detection and analysis of anti-analysis functions. This is expected to reduce the operational costs and personal dependency related to the detection and analysis of evasion functions and improve the efficiency of work related to dynamic analysis.

[0093] It is also expected that the support results of this Example 1 can be applied to system recovery and countermeasure automation. For example, it is conceivable to automatically execute countermeasures to prevent malware infection based on the extracted anti-analysis functions, specifically, when it is determined that the anti-analysis function in a virtual environment has detected a specific key in the registry, to set the value of that key to avoid infection. [Example]

[0094] In the second embodiment, the processing of a malware analysis system that not only provides malware analysis support on-premise but also makes the support function available externally via a network, thereby enabling the provision of services in the cloud is described.

[0095] The second embodiment will be described below, focusing on the differences from the first embodiment.

[0096] 11 is a diagram showing an example of the configuration of an anti-analysis function detection system 1101 according to a second embodiment of the present invention. The configuration of the computer system of the second embodiment is the same as that of the first embodiment, and therefore a description thereof will be omitted.

[0097] The hardware configuration of the malware analysis system of the second embodiment includes an external user terminal 1120 in addition to the hardware configuration of the first embodiment. In the second embodiment, each program executes processing in response to a request from not only the user terminal 1117 within the network but also the external user terminal 1120, and returns the results to the external user terminal 1120 via the Internet 1119. This enables services to be provided in the cloud.

[0098] The programs of the second embodiment are the same as those of the first embodiment. In addition, the processes executed by the dynamic analysis program 1108, the CFG creation program 1109, the branch identification program 1110, and the screen depiction program 1111 of the second embodiment are the same as those of the first embodiment. The data structure of the second embodiment is the same as that of the first embodiment.

[0099] The configuration of the analysis avoidance function detection system 1101 according to the second embodiment, which is described with reference to FIG. 11, is merely an example and is not limiting.

[0100] According to the second embodiment, the anti-analysis function detection system 1101 provides an anti-analysis function detection function to internal users on-premise, as in the first embodiment, and also provides similar information to external users via the Internet 1119. This enables the provision of services in the cloud.

[0101] According to the above embodiment, dynamic analysis logs from multiple environments are merged to create a control flow graph, signatures related to the graph patterns are used to detect branches related to evasion functions, and the relevant parts of the log and related information are output. This supports the detection and analysis of evasion functions, reducing operational costs and the dependency on individual personnel.

[0102] In the above embodiment, an example of performing dynamic analysis of malware using multiple dynamic analysis units is described, but the present invention is not limited to this, and dynamic analysis of malware may also be performed using a single dynamic analysis unit. [Explanation of symbols]

[0103] 101: Malware analysis support system 102:IF 103:CPU 104: Main memory 105: Storage device 106: Input / output device 107: Communication channel 108: Dynamic analysis program 109: CFG creation program 110: Branch specific program 111: Screen drawing program 112:Malware List 113: Dynamic analysis result storage area 114: Dynamic analysis results list 115: CFG analysis results list 116: Signature list 117: User terminal 118: Network 119: Internet

Claims

1. A system for detecting anti-analysis functions of malware connected to the Internet, comprising: a plurality of dynamic analysis units that perform dynamic analysis of the malware; a control flow graph creation unit that creates a control flow graph related to the malware by merging dynamic analysis results of the plurality of dynamic analyses performed by the plurality of dynamic analysis units; a branch identification unit that detects the evasion function by identifying a branch related to the evasion function of the malware in the control flow graph using a predetermined signature; a screen rendering unit that presents the malware's evasion function as support information to an analyst; 1. An anti-analysis function detection system comprising:

2. The dynamic analysis unit The anti-analysis function detection system according to claim 1, wherein the malware is dynamically analyzed by actually running the malware for a certain period of time.

3. The control flow graph creation unit 2. The anti-analysis function detection system according to claim 1, wherein the control flow graph is created by comparing and merging relationships among a plurality of the dynamic analysis results.

4. The branch identification unit 2. The anti-analysis function detection system according to claim 1, wherein the branch is identified from the control flow graph, and a function causing the branch is detected.

5. The branch identification unit 5. The anti-analysis function detection system according to claim 4, wherein the branch in the control flow graph is identified by comparing the branch with the signature.

6. The branch identification unit 6. The anti-analysis function detection system according to claim 5, wherein the signature is one of the function, a pattern of the control flow graph, and a combination of the pattern of the control flow graph and the function.

7. The branch identification unit 7. The anti-analysis function detection system according to claim 6, wherein the branches are identified based on differences in patterns of branch destinations of the branches in the control flow graph.

8. The branch identification unit 2. The anti-analysis function detection system according to claim 1, wherein the branch is identified by comparing a plurality of the control flow graphs and analyzing the differences.

9. A user terminal connected via a predetermined network is included, The screen drawing unit 2. The analysis avoidance function detection system according to claim 1, wherein the support information is displayed on a screen of the user terminal.

10. The screen drawing unit The analysis evasion function detection system according to claim 9, wherein the support information includes a malware summary of the malware and an evasion function detection result of the evasion function, and the support information is displayed on the screen of the user terminal.

11. The malware summary includes: dynamic analysis results of a plurality of said dynamic analyses; The avoidance function detection result is 11. The analysis avoidance function detection system according to claim 10, further comprising a function related to the analysis avoidance function and a dynamic analysis environment of the dynamic analysis unit that has been avoided.

12. an external user terminal connected to the Internet; The screen drawing unit The analysis avoidance function detection system according to claim 1, wherein the support information is displayed on a screen of the external user terminal.

13. 1. A method for detecting evasion functions of malware connected to the Internet, comprising: a plurality of dynamic analysis steps in which a dynamic analysis unit performs dynamic analysis of the malware; a control flow graph creation step in which a control flow graph creation unit creates a control flow graph related to the malware by merging dynamic analysis results of the plurality of dynamic analyses performed by the plurality of dynamic analysis units; a branch identification step of detecting the evasion function by identifying a branch related to the evasion function of the malware in the control flow graph using a predetermined signature by a branch identification unit; a screen drawing step of presenting the evasion function of the malware as support information to an analyst by a screen drawing unit; 1. A method for detecting an anti-analysis function, comprising:

14. The branch identification step includes:

14. The method for detecting an anti-analysis function according to claim 13, wherein the branch is identified from the control flow graph, and a function causing the branch is detected.

15. The branch identification step includes: The method of claim 14, wherein the branch in the control flow graph is identified by comparing the branch with the signature.

Images