惡意PowerShell腳本的自動解混淆方法

Abstract

多年來，惡意程式一直是攻擊者用以大範圍攻擊的好選擇之一。有鑑於此，許多使用者對於副檔名為執行檔(exe)的程式也會特別有警覺，避免下載、點擊執行該類檔案，避免電腦中毒。但是對於許多文字檔(doc)、表格檔(xls)等卻不會有同等的警覺心，所以攻擊者開始將惡意程式碼夾帶於此類檔案中，用此類檔案降低使用者的戒心來增加攻擊的成功率。 夾帶於上述文字檔、表格檔中的惡意程式碼可用多種語言編寫，但其中PowerShell語言因為有著強大的功能也易於混淆，且PowerShell語言是Windows作業系統中的預設安裝的殼程式，因此有許多的攻擊者便選用PowerShell語言來編寫這些惡意程式。這些惡意程式碼為了繞過防毒軟體，避免被其偵測到，同時為了避免被研究人員輕易分析，因此攻擊者多會使用一至數種的混淆方式將程式碼混淆，以此繞過防毒軟體的偵測，並增加研究人員分析的困難度。 我們提出了一個自動化去除這些經混淆的惡意PowerShell腳本的方法。在我們的架構中，會先利用機器學習為基底的分類器來分辨此混淆的程式碼使用了哪種混淆方式，再根據分類結果來解混淆。由於一個混淆的程式碼可能會使用不只一種混淆方法，所以我們會將解過混淆之程式碼再重新送至分類器中做分類及解混淆，直到我們的分類器認為該程式碼已經不再有混淆為止。 在我們的資料集中，我們將混淆方法分為8種，並針對每種混淆方法開發解混淆方式；在分類器方面也選用多種機器學習方法，來分析和比較各種機器學習模型的準確度。

For many years, malware is a good choice for attackers to launch a large-scale attack. Therefore, many users are particularly alert to programs whose extensions are .exe, avoiding downloading or executing such files to protect their computer from this kind of attack. On the contrary, users do not have the same alertness to Microsoft Word documents or Microsoft Excel documents, since they use such files too often, and they look very harmless. As a result, attackers are increasingly utilizing Word, Excel etc. documents as a malicious script carrier. There are many options for attackers to write these malicious scripts; however, PowerShell is favored by many attackers since it is a very powerful language and it is a pre-installed shell scripting language on Windows machine. To bypass anti-virus system, and to increase the analysis difficulty for the researcher, attackers usually use many methods to obfuscate their malicious script. We proposed a system to de-obfuscate these obfuscated malicious PowerShell scripts. In our system, we use machine learning-based classifier to identify which obfuscation method is use in the target script, and then de-obfuscate it. However, attackers may use many obfuscation methods in one file, so we will send the result back to the classifier and de-obfuscate it until our classifier think that file is totally de-obfuscated. In our dataset, we divide the obfuscation methods into 8 types, and develop a de-obfuscation method for each type. Besides, a variety of machine learning methods are used in the classifier to analyze and compare the accuracy of various machine learning models.