Command Control Server Detection via Malware Decryption Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to efficiently detect and neutralize command control servers of malicious applications, particularly voice phishing applications, due to their sophisticated obfuscation techniques and the large number of apps being distributed, necessitating an urgent need for automated extraction methods.
Innovation Solution
An apparatus and method for analyzing malicious applications, including a collection unit, inspection unit, malicious type determination unit, and command control server detection unit, which employs various decryption methods such as AES-128 in ECB and CBC modes and BASE64 encoding to identify and decrypt encrypted information about command control servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated detection methods are implemented, then productivity increases, but device complexity increases
Solution Approach 1:
The detection system is divided into multiple specialized modules: collection unit for gathering malicious apps, inspection unit for checking app status, malicious type determination unit for classifying app categories, and command control server detection unit for extracting server information. Each module handles a specific aspect of the detection process, enabling automated high-speed detection while maintaining manageable system complexity through functional segmentation.
Solution Approach 2:
The apparatus is designed to handle multiple malicious application types (first type with encrypted files, second type with encrypted classes, third type with communication information) using a unified detection framework. The system can process different encryption methods (AES-128 ECB, AES-128 CBC, BASE64) and extract command control server information from various app structures through a single multi-functional detection system.
2Measurement precision
If decryption methods are applied to encrypted information, then measurement precision improves, but use of energy increases
Solution Approach 1:
The system performs preliminary classification of malicious application types before applying decryption methods. The malicious type determination unit identifies whether the app contains encrypted files (first type), encrypted classes (second type), or communication information (third type), and determines the encryption method used. This preliminary action allows the detection system to apply only the necessary decryption approach, avoiding unnecessary energy consumption while ensuring accurate extraction of command control server information.
Solution Approach 2:
The system adapts its decryption parameters based on the identified encryption method. When AES-128 ECB mode is detected, one decryption parameter set is applied; when AES-128 CBC mode is detected, a different parameter set is used; for BASE64 encoding, yet another approach is taken. This dynamic parameter adjustment ensures precise decryption with minimal energy expenditure by avoiding trial-and-error decryption attempts.
Data Source
AI summary
Provided is an apparatus for detecting a command control server, the apparatus including: a collection unit configured to collect a malicious application; a malicious type determination unit configured to analyze the malicious application to determine a malicious type of the malicious application; and a command control server detection unit configured to detect a command control server associated with the malicious application based on the determined malicious type.