ARIA加密算法的识别规则提取和检测

Identification Rules Extraction and Detection of ARIA Encryption Algorithm

目前很多恶意软件都会使用各种加密算法来隐藏其病毒特性,针对恶意代码样本中使用的ARIA加密算法,通过对加密算法源码和二进制文件的分析,从密钥盒、应用程序编程接口函数、初始化数据、字符串以及指令流等不同维度来提取ARIA加密算法的特征,构造出算法识别的YARA规则。经测试验证表明,提取规则可以帮助网络安全分析人员准确识别恶意样本和可疑程序中是否使用ARIA加密算法来隐匿特征。

Nowdays,many malicious softwares use various encryption algorithms to conceal their virus characteristics.The ARIA encryption algorithm used in malicious code samples is proposed.By analyzing the source code and binary file of the ARIA encryption algorithm,the characteristics of the algorithm are extracted from different dimensions such as key box,application programming interface function,initialization data,character string,and instruction stream and the YARA rules are constructed to recognize the ARIA encryption algorithm.Tests show that the extracted rules can help network security analysts accurately identify whether the ARIA encryption algorithm is used to hide features in malicious samples and suspicious programs.