Towards Malware Author Attribution

2008年，赛门铁克在其恶意软件数据库中增加了160万个新的恶意软件签名。这一数字在2009年增加到290万。2010年，数据库新增签名440万个。这一趋势仍在继续，2011年恶意软件的增长率达到了41%。主要基于识别记录良好的威胁（签名）的传统方法正在努力科普每年恶意软件数量的这种增长速度。因此，大多数恶意软件菌株（其中许多是短暂的，即，不到24小时），不被发现。传统方法的这种不足暴露了对替代防御的迫切需要。我们建议将注意力转向恶意软件源，即恶意软件作者。这种策略的好处是显而易见的：我们可以有效地描述其作者生成的所有恶意软件变体，而不是检测每个恶意软件菌株。我们建议研究恶意软件作者归属背后的理论和实践。虽然作者归属，一种技术，旨在确定一个作者的文件，作者的写作风格从他以前的作品中提取的一些文本特征，是在社会科学中很好地建立，它提出了许多研究问题，在恶意软件检测领域。例如，我们如何定义作者（例如，恶意软件生成引擎，恶意软件活动，个人），以便可以利用它进行自动和准确的检测，并在源代码和二进制代码中嵌入可追溯到其作者的独特功能。

In 2008 Symantec added 1.6 million new malware signatures to its malware database. This number increased to 2.9 million in 2009. In 2010, the new addition to the database constituted 4.4 million new signatures. This trend continued, and in 2011 an increase in malware has reached 41%. Traditional approaches predominantly based on recognizing well-documented threats (signatures) are struggling to cope with this rate of growth in malware numbers each year. Consequently, the majority of malware strains (many of which are short lived, i.e., less than 24 hours) go undetected. This inadequacy of traditional approaches exposes a dire need for alternative defences. We propose to turn our attention to malware source, i.e, malware authors. The benefit of such a strategy is clear: instead of detecting every malware strain, we could effectively characterize all malware variants generated by its author. We propose to study the theory and practice behind malware author attribution. Although authorship attribution, a technique aiming to determine an author of a document given some textual characteristics of the author's writing style extracted from his previous works, is well established in social science, it raises many research questions in malware detection domain. For example, how can we define an author (e.g., malware generation engine, a malware campaign, an individual) so that it can be leveraged for automatic and accurate detection, and to what extend source and binary code embed distinct features traceable to its author.**