title: ÐÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð² Ð¸Ð·Ð¾Ð»Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ ÑÑÐµÐ´Ð°Ñ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Identification of malware based on behavioral analysis in isolated execution environments using machine learning methods
Creators: name: Ð­Ð¿Ð¿, ÐÐ°ÐºÑÐ¸Ð¼
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ
Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·
Ð¸Ð·Ð¾Ð»Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÐµ ÑÑÐµÐ´Ñ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ
Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
malware detection
behavioral analysis
isolated execution environments
machine learning

description: ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. Ð¦ÐµÐ»Ñ ÑÐ°Ð±Ð¾ÑÑ â Ð¿Ð¾Ð²ÑÑÐ¸ÑÑ ÑÐ¾ÑÐ½Ð¾ÑÑÑ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð² ÑÑÐµÐ´Ð°Ñ Ð¸Ð·Ð¾Ð»Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ð·Ð° ÑÑÐµÑ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ, Ð½Ðµ ÑÐ¼ÐµÐ½ÑÑÐ°Ñ Ð¿ÑÐ¸ ÑÑÐ¾Ð¼ ÑÐºÐ¾ÑÐ¾ÑÑÑ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ñ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð°Ð»ÑÐ½ÑÑ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ÑÑÐµÐ¹ ÑÑÐµÐ´ Ð¸Ð·Ð¾Ð»Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ, Ð° ÑÐ°ÐºÐ¶Ðµ Ð°ÐºÑÑÐ°Ð»ÑÐ½ÑÑ ÑÐµÑÐ½Ð¸Ðº Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼. ÐÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½ ÑÐ¾Ð±ÑÑÐ²ÐµÐ½Ð½ÑÐ¹ Ð¼ÐµÑÐ¾Ð´ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ ÐÐÐ, Ð¾ÑÐ½Ð¾Ð²Ð°Ð½Ð½ÑÐ¹ Ð½Ð° Ð°Ð½Ð°Ð»Ð¸Ð·Ðµ Ð²Ð¾Ð·Ð²ÑÐ°ÑÐ°ÐµÐ¼Ð¾Ð¹ Ð² Ð¿ÑÐ¾ÑÐµÑÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼ WinAPI-ÑÑÐ½ÐºÑÐ¸ÑÐ¼Ð¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¸. ÐÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð½ÑÐ¹ Ð¼ÐµÑÐ¾Ð´ ÑÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¼Ð¾Ð´ÑÐ»Ñ Ð´Ð»Ñ Ð¿Ð¾Ð¿ÑÐ»ÑÑÐ½Ð¾Ð¹ ÑÑÐµÐ´Ñ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ CAPE. ÐÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð° Ð¾ÑÐµÐ½ÐºÐ° ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð¼Ð¾Ð´ÐµÐ»Ð¸ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ, ÑÐµÐ°Ð»Ð¸Ð·ÑÑÑÐµÐ¹ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð½ÑÐ¹ Ð¼ÐµÑÐ¾Ð´Ð°. ÐÐ¾ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ°Ð¼ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ¾Ð² Ð¼Ð¾Ð´ÐµÐ»Ñ Ð´ÐµÐ¼Ð¾Ð½ÑÑÑÐ¸ÑÑÐµÑ Ð²ÑÑÐ¾ÐºÐ¸Ðµ Ð·Ð½Ð°ÑÐµÐ½Ð¸Ñ Ð¼ÐµÑÑÐ¸Ðº ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð¸ Ð½Ð¸Ð·ÐºÐ¾Ðµ Ð¿Ð¾ÑÑÐµÐ±Ð»ÐµÐ½Ð¸Ðµ ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ ÑÐµÑÑÑÑÐ¾Ð², ÑÑÐ¾ Ð´ÐµÐ»Ð°ÐµÑ ÑÐµÐ»ÐµÑÐ¾Ð¾Ð±ÑÐ°Ð·Ð½ÑÐ¼ ÐµÐµ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¼Ð¾Ð´ÑÐ»Ñ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ ÑÑÐµÐ´Ñ Ð¸Ð·Ð¾Ð»Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ.
description: This work is devoted to the study of methods for identifying malicious software based on behavioral analysis. The goal of the work is to improve the accuracy of malware detection in isolated execution environments through the use of machine learning methods, without reducing the speed of analysis. During the work, research was carried out on the functionality of isolated execution environments, as well as current machine learning techniques for identifying malware. A proprietary method for detecting malware is proposed, based on the analysis of information returned during program operation by WinAPI functions. The proposed method is implemented as a module for the popular CAPE runtime. The effectiveness of the machine learning model implementing the proposed method was assessed. According to the experimental results, the model demonstrates high values of machine learning efficiency metrics and low consumption of system resources, which makes it advisable to use it as a machine learning module for an isolated execution environment.