论文标题
评估恶意软件取证工具
Evaluating Malware Forensics Tools
论文作者
论文摘要
我们提供了先前发布的恶意软件分析工具评估框架（MATEF）的示例实现，以探索是否可以建立用于评估法医研究中使用的恶意软件伪像检测工具的系统基础。通过案例研究证明了框架的应用，该案例研究提出了两个示例实验的设计，这些实验考虑了假设：（1）在观察恶意软件行为时，工具之间是否有最佳的执行恶意软件进行执行恶意软件的时间长度？实验使用了已知产生网络人工制品的4,800个文件的样本。这些是从超过350,000个恶意软件二进制文件的库中随机选择的。在数字法医社区中流行的工具过程监视器和TCPVCON被选为研究这两个问题的主题。结果表明，可以使用MATEF来确定用于监视恶意软件生成的活动的软件工具的最佳执行时间。
We present an example implementation of the previously published Malware Analysis Tool Evaluation Framework (MATEF) to explore if a systematic basis for trusted practice can be established for evaluating malware artefact detection tools used within a forensic investigation. The application of the framework is demonstrated through a case study which presents the design of two example experiments that consider the hypotheses: (1) Is there an optimal length of time in which to execution malware for analysis and (2) Is there any observable difference between tools when observing malware behaviour? The experiments used a sample of 4,800 files known to produce network artefacts. These were selected at random from a library of over 350,000 malware binaries. The tools Process Monitor and TCPVCon, popular in the digital forensic community, are chosen as the subjects for investigating these two questions. The results indicate that it is possible to use the MATEF to identify an optimal execution time for a software tool used to monitor activity generated by malware.
