چكيده به لاتين
Rapidly growth of the number of malicious programs which are generated by altering the functionalities or code structure caused the growth of paying attention to malware behavioral analysis. Security vendors leverage dynamic analysis techniques to screen malware behaviors, but malware use evasion techniques to avoid being monitored by a sandbox. Therefore, a subset of malware behaviors would be captured. Malicious programs show their roguish behavior while specific conditions are triggered. The existence of a file, a registry file, Internet connection, user interactions, date, time or other environmental conditions are various types of these conditions which should be triggered to capture malware roguish behaviors. Related works utilized software testing methods to observe more behavior but path explosion or solver problems cause to be failed. In this work, we studied on user interactions. We implemented 46 user activities to simulate user's interactions. While a malware is analyzed within a sandbox, some of these user's interactions effects on the analysis environments. Then, these user's interaction triggers relevant malware behaviors. We evaluated the work by 550 malicious samples. Comparison with the generated report by the cuckoo sandbox. The generated report by cuckoo sandbox within the proposed user's interaction caused to screen new progress and new system calls on 17.8% and 20.7% of samples respectively.
