Imed El

Imed El Fray
email: ielfray@zut.edu.pl

Tomasz Hyla
email: thyla@zut.edu.pl

Włodzimierz Chocianowicz
email: wchocianowicz@zut.edu.pl

Protection Profile for secure sensitive information system on mobile devices

Keywords: Mobile device, Sensitive information, Originator Controlled Access Control, Secure Protection Module, Protection Profile

The mobility of the user and information is a factor that should be taken into account during the design and development of mechanisms protecting the sensitive stored, exchanged and processed information on mobile devices. This paper discusses the security profiles for the user and dispatcher subsystems protecting sensitive information on the mobile device called MobInfoSec. MobInfoSec is a system providing users with secure sensitive documents by using the specialized class SP cryptographic module, which protects directly the trusted system components through implementing ORCON access control rules. Protection Profile defines the security functional requirements for MobInfoSec system executing the encryption/decryption of documents based on addressed access policies. The article includes a general description of MobInfoSec system, including assets, assumptions, threats, policies and functional requirements necessary for the evaluation of security functions developed in accordance with requirements of the standard ISO/IEC 15408 (called the Common Criteria).

Introduction

Today such terms as privacy, security, mobility of users and information or mobility of the information itself are important features of the information systems that must be considered during the design and development of protection mechanisms of sensitive information. The importance of the systems dedicated to the mobile platforms has grown significantly in recent years. Mobility of information requires that the level of information protection, regardless of its location, must be the same as in the case of local information. The achievement of this level of protection requires the design and implementation of systems in the manner preventing the access to information by unauthorized entity (especially if confidential or classified information is the case).

The growing number of mobile users (private or business ones) who store sensitive data on such devices requires strong access control mechanisms. These requirements can be met by using the Originator Controlled (ORCON) access control model [START_REF] Yu-Yuan | Hardware-Assisted Application-Level Access Control[END_REF]. It is assumed in this model that each document has its owner. However, an access must be controlled by a dispatcher of the document (i.e. the entity that has the right to share the document on behalf of the owner). The owner can determine who shares a document, but the final decision is up to the document dispatcher. The user of the document (who was given the access right from the dispatcher) can't copy it or share it with other users without the consent of the dispatcher. The solution based on ORCON model will allow the achievement of two objectives:

security of mobile information release of the user from the obligation to monitor any classified information contained in his/her mobile device.

A noticeable rapid increase in the number of identified vulnerabilities and attacks on mobile systems, and the lack of a system that clearly and transparently enforces the protection of sensitive information collected from various sources and stored on mobile devices, justify the need to design and develop new mechanisms to improve the security of information processed on mobile devices. This paper presents protection profiles for the user system of information processed and stored on a mobile device, and the dispatcher system as well. It is assumed that the mobile device allowing an access to sensitive information will be a part of the proposed MobInfoSec system described in [START_REF] Hyla | Sensitive Information Protection on Mobile Devices Using General Access Structures[END_REF]. Typically, such systems must be centralized in a way enabling each entity to download the protected sensitive information properly. The access to the system can only be obtained by the entity or entities from the group who meet the conditions specified in the access policy integrally related to the downloaded sensitive information.

Due to such features, the sensitive information will be available not only within the information management system, but also on any mobile device (called an ORCON class), in contrast with existing systems.

This paper contains the description of the ORCON access control model (in Section 2) and the description of the MobInfoSec system (in Section 3). Section 4 contains the identified assets, assumptions, threats, the security policy and selected functional requirements of the above-mentioned system, all together realizing the security goals.

Originator Controlled Access Control

One of the biggest challenges for the protection of the sensitive information is to create such an access control system where, under the assumption that the creator of the document (or the institution acting on its behalf) has no control over the operating user system of the document, it would be possible to control the process of sharing documents distributed by the author to the others. By using the existing cryptographic mechanisms one can protect the documents in such a way, that only an authorized person has an access to them. In contrast, it is difficult to protect them against an internal attacks, when a dishonest user having access rights to the file intends to distribute these rights further without permission of the author.

The ORCON [START_REF] Yu-Yuan | Hardware-Assisted Application-Level Access Control[END_REF] access control rules, which require that the author of the document have full control over its dissemination, allow the creation of such a system to control an access to the classified information in order to protect the document against internal attacks. However, due to the fact that modern operating systems together with the software can be freely modified by an attacker, the effective implementation of the ORCON model is a difficult task. It results from the fact that the attacker can preview the contents of memory at any time, and thus can gain unauthorized access to a document which always must be decrypted before being displayed on the mobile device screen [START_REF] Hyla | Sensitive Information Protection on Mobile Devices Using General Access Structures[END_REF][START_REF] Pejaś | ORCON access control monitored by the initiator: theoretical and practical implementation method[END_REF].

In order to achieve more functionality, the hybrid ORCON model has been created. This model combines the features of MAC and DAC models/strategies. In this model it is assumed that each resource (document) has its owner. The owner may be the author of the document, but this is not necessary. The document owner has the authority to manage his/her documents, for example he/she may have to read, write or update rights. The owner may transfer these rights to other users of the system. Users are endowed with such a right, but they cannot pass it on -this applies to the same document and all copies thereof. The access to the document can only be granted after its owner approval. This rule distinguishes ORCON model from the basic models (MAC, DAC, RBAC).

ORCON model rules proved to be particularly important in the case of the sensitive information of high importance (the security of the government institutions as an example), as suggested by the authors [START_REF]Protection of sensitive information[END_REF][START_REF] Hołyst | Cybercrime, information security and cryptology, Prosecution and Law[END_REF]. The example of using the ORCON model in this context is provided in [START_REF] Bishop | Computer Security: Art and Science[END_REF].

As mentioned above, the hybrid ORCON model draws its principles from models of MAC and DAC. ORCON requirements can be fulfilled only by bringing together some of the features of MAC and DAC. The idea of this was presented in [START_REF] Yu-Yuan | Hardware-Assisted Application-Level Access Control[END_REF][START_REF] Bishop | Computer Security: Art and Science[END_REF] and consists of describing the ORCON model as a function of the requirements which are fulfilled by MAC and DAC models:

the owner of the resource cannot itself to change the access rules for MAC; when copying a resource, the access restrictions are copied along with the access to the resource and attributed to its copies (access to a copy is identical to the original); the resource originator can change the access rights of other entities too.

One can notice that the first two principles are under the control of MAC (not under the control of the owner), while the third rule is consistent with DAC and is subjected to the owner control.

The main problem related to ORCON model is of an architectural and implementation nature, i.e. how to meet ORCON objectives effectively. In this model it is important to define an arbitrary and dynamic access structure. There are many approaches for the implementation of access structures (ACL, cryptographic techniques using special SP hardware modules [START_REF] Yu-Yuan | Hardware-Assisted Application-Level Access Control[END_REF], etc.).

When building the flexible access structures, special attention should be paid to the secret sharing methods [START_REF] Shamir | How to share a secret[END_REF][START_REF] Blakley | Safeguarding cryptographic keys[END_REF], which allow to create dynamic structures [START_REF] Benaloh | Generalized secret sharing and monotone functions[END_REF][START_REF] Tassa | Hierarchical threshold secret sharing[END_REF][START_REF] Nakielski | Simple dynamic threshold decryption based on CRT and RSA[END_REF]. When designing advanced algorithms, secret sharing can tend to create structures with specific topologies or structure topology defined by the resource owner.

The detailed description of ORCON access control model (including examples) was presented in [START_REF] Yu-Yuan | Hardware-Assisted Application-Level Access Control[END_REF][START_REF] Hyla | Sensitive Information Protection on Mobile Devices Using General Access Structures[END_REF][START_REF] Pejaś | ORCON access control monitored by the initiator: theoretical and practical implementation method[END_REF][START_REF] Bishop | Computer Security: Art and Science[END_REF]. Below the protection profile of the MobInfoSec system is described. This system is evaluated for the compliance with the requirements of the Common Criteria (EAL4 level).

Description of MobInfoSec system

The subject of the protection profile is the system of cryptographic protection of the sensitive information on the mobile devices (MobInfoSec). The system consists of four basic subsystems:

-Dispatcher subsystem, -User subsystem, -Policies and assertions management subsystem, -Cryptographic and PKI services subsystem and two auxiliary Subsystems: standard trusted subsystem and mobile device protection subsystem.

All the above mentioned subsystems are functionally combined into a single integrated system.

The following Figure 1 highlights the important software components included in MobInfoSec system. DS is used to generate the addressed access policies and to encrypt documents with sensitive information in accordance with those policies. DS can be embedded on a stationary device, and on a mobile device as well. The subsystem consists of two components:

TOE -System for protection of sensitive information on the mobile device

-Trusted Register of Public Documents: The component is responsible for collecting public documents developed by the authors, which can be encrypted by Generator of Secured Documents;. -Generator of Secured Documents: The component is responsible for issuing requests to generate addressed access policies and to encrypt the specified document under the terms of the policy.

Policies and Assertions Management Subsystem (PAMS)

PAMS is used to generate and provide an addressed access policy and its templates to a standard trusted subsystem, and to generate and make available information concerning assertion users and mobile devices based on the catalogue of trusted users and devices. The subsystem consists of three following components.

-Addressed Access Policies and Templates Generator: The component generates the addressed access policy and its templates associated with the document in response to the request received from the DS. Generated Policies and their templates are provided and published by the trusted server, so called "Server of Addressed Access Policies and Templates". All generated policies and their templates are stored in the "Templates Magazine of Addressed Access Policies". -Assertion Generator: The component allows to register, generate and publish assertions compatible with the selected profile and format, and to certify the existing imported assertions (e.g. from the server of data distribution which authenticates trusted external users and devices, confirming the different rights and privileges of sensitive information users). The generated assertions are published in the standard trusted subsystem (STS) called "Assertion Trusted Server". All generated and cancelled internal and external assertions (generated outside the MobInfoSec system) are stored in the "Assertions Magazine". -Users and Mobile Devices Register: The component contains information about the users and their associated devices operating under MobInfoSec system, and their status (e.g. whether the unit is a combination of registered trusted software and SP module). Users and devices withdrawn from the registry (catalogue) do not have the right to decrypt any document containing sensitive information, regardless of their previously granted rights. Making available and removing users and devices from the system, and the relationship between them, is under the control of the "Users and Devices Trusted Server", and is registered in "Users and Mobile Devices Magazine".

PKI and Cryptographic Services Subsystem (PKI_CSS)

This subsystem is a service provider generating keys for the purpose of users and devices authentication, data encryption and decryption, and secure communication within the External PKI Services Subsystem and External PKI Services Module Subsystem. The subsystem consists of three following components.

-

User Subsystem (US)

US is used to authenticate and authorize users and mobile devices, and to distribute access policies to the mobile device. US is also used to enforce the access policy in the case of decryption. A trusted or untrusted (produced by external suppliers) application presenting the data subjected to access policy may be located in US. The subsystem consists of two main components (the Trusted Software and the Trusted Data Storage).

-Trusted Software: This component includes the software which integrity is protected by the main module of trusted software ("watchman") operating in MDPS (see: 3.5). -Trusted Data Storage: This component is "the protected data storage" containing evidences concerning the user of the mobile device (certificates, optionally private keys and basic assertions), Root CAs certificates (trust points) and the decrypted document. The integrity of this storage is protected by the trusted software module ("watchman") operating in MDPS (see: 3.5).

Mobile Device Protection Subsystem (MDPS)

MDPS contains a dedicated cryptographic module called SP module. SP module protects directly the trusted US components implementing ORCON rules. This protection is possible by controlling the integrity of the code and configuration data.

The subsystem consists of two following components.

-Secret Protection Token: This component provides the functionality of Trusted Platform Module (two keys, one for an authentication and one for an access to the storage), the encryption and decryption keys from Cryptographic Keys Storage, and it includes registers and codes needed to verify the integrity and enforcing certain behaviour in the case of incorrect integrity verification (blocking the action of a trusted code). -Cryptographic Key Storage: This component is used to securely store keys used to authenticate users or devices, and to carry out the operations of encryption and decryption of data.

Standard Trusted Subsystem (STS)

STS is the subsystem intermediary between DS, US and PAMS. This subsystem is used to share and distribute the addressed access policies templates and assertions, data authentication of users and devices, and serves as the register of published addressed policies. STS also works with PKI_CSS under the control of e.g. PKI Proxy Gateway. The subsystem consists of two following components.

-External Trusted Server of Addressed Policies Templates, Addressed Access Policies and Assertions Distribution: This component retrieves addressed policies templates of PAMS. These templates are then made available for the preparation of PD addressed access policies. Prepared addressed access policies are taken by mobile devices. This component also provides assertions to mobile devices and PD in order to implement the process of authentication and encryption/decryption of data.

-External Trusted Server of Authentication Data Distribution and Users/

Devices Authentication: This component distributes information about the users and devices (such as information about their groups, roles) stored in the MobInfoSec system to other components of the system, and authenticates them on request.

The detailed description of all mentioned above components and architecture of individual subsystems, together with examples of business scenarios, are described in [START_REF] Hyla | Sensitive Information Protection on Mobile Devices Using General Access Structures[END_REF]. Below, in accordance with the guidelines of the Common Criteria [START_REF]Information technology -Security techniques -Evaluation criteria for IT security", Part 1: Introduction and general model[END_REF][START_REF]Information technology -Security techniques -Evaluation criteria for IT security", Part 2: Security functional requirements[END_REF][START_REF]Information technology -Security techniques -Evaluation criteria for IT security[END_REF], the following items are defined: assets, assumptions, threats and security policy, and then the policy goals counteracting security threats and supporting the security policy and security functional requirements. The security objectives rationale for threats, security policies, etc., were deliberately omitted, because they are an effect of the aggregation of data resulting from the specified chain of events describing the threat, politics, etc., contained in the following tables.

Protection Profile for MobInfoSec systems 4.1

The assets off the system This section describes the most important assets that should be protected by the system.

Table 2. The main assumption of MobInfoSec system

AE. Configuration of MobInfoSec system

It is assumed that: -MobInfoSec is properly installed and configured (virus protection is ensured, dedicated access to the system functions, etc.); all SF are properly configured in such a way as to ensure that the security policies will be enforced on all connections associated with the components of MobInfoSec.

AE. Access policies for sensitive information

It is assumed that an access to classified information is protected in MobInfoSec in accordance with the following principles of ORCON model:

the resource (document, classified information) has a creator who is authorized to process the document (he/she does not have permission to access rights management); the dispatcher of resource (document, classified information) manages the access rights on behalf of the creator; copies of the resource (document, classified information) have the same access restrictions as the original resource (nobody can create copies with other privileges); the entity that granted the right to access the resource from the dispatcher may temporarily delegate the right to access to a third party, provided that confidence in the assertion and attribute certificates of that party will be at least at the same level as confidence in the assertion and attribute certificates of party delegating their rights of access.

AE. Authenticity of a policy origin

It is assumed that the addressed access policies used by TOE and their templates are authentic.

AE. Cryptographic module of a mobile device

It is assumed that the mobile device has a SP class security module. SP module directly or indirectly allows, among others:

secure storage of cryptographic objects (including keys) and data; device authentication; authentication and integrity check of local software enabling access to classified information; authorize access to the document on the basis of policies, certificates and attribute assertions; document decryption; protection (or separation) of the portion of operational memory in which the decrypted document is stored (to protect against unauthorized reading).

The threats in the system

Threats must be identified in order to accurately determine the security requirements.

Because the threat is a result of the attack on the assets, it is important to correctly identify these attacks, especially those which use the currently known vulnerabilities in mobile devices [START_REF]Fortinet's FortiGuard Labs "Reveals Newest of mobile Malware Trends in Latest Threat Report[END_REF][START_REF]Mobile threat report[END_REF]. Table 2 shows the identified threats of MobInfoSec system.

Table 3. The most important identified threats of the MobInfoSec system.

T. Damage to the system

Accidental or intentional damage to the system.

-Accidental damage to the functions and/or parameters of the system can occur, for example, when entity encrypting or decrypting data removes one or more components of hardware and/or software, which are part of the system. -Deliberate damage may occur as a result of attempts to modify the components of the system by an attacker, for example, by installing false programs or applications without the knowledge of users. This damage can lead to the creation of the invalid ciphertext, the creation of the ciphertext without the knowledge of the dispatcher of the document, the creation of the ciphertext using spoofed addressed access policies, the input data validation damage or the damage to the decrypted data, etc. T. Unauthorized access to the system Malicious user, process or an external entity may mask as an authorized entity to gain unauthorized access to data or system resources or misrepresent yourself as a system to obtain data authentication and authorization belonging to the entities having the rights to the encryption /decryption.

T. Modification of documents set

An attacker can modify the list of selected documents for encryption, e.g. by installing false software, applications, or as a result of damage to the system code.

T. Substituting data

One or several components responsible for the form of representation of the encrypted or decrypted data can be substituted (e.g. false application) during the process of creating the ciphertext or during the transfer of it to the mobile device in order to decrypt by the user. This threat could lead to the creation of the ciphertext based on data different from those that have been selected by the dispatcher. The same applies to the decryption process by the user.

T. Malicious or flawed applications

Applications run on a mobile device may contain malicious executable code. This code can be used unconsciously or deliberately by the author (e.g. programmer), may also be a part of the software library. Malicious applications may try to publish data to which they obtained unauthorized access. They can also perform the attacks on the system platform that will provide them with additional privileges. Malicious applications may be able to control mechanisms to capture the signals from the sensors embedded in devices (e.g. GPS, camera, microphone) and to collect in this way information and data transmitted or residing on the device.

T. Unauthorized application update

A malicious third party may attempt to deliver end-user application updates that may compromise the security functions of the system.

T. Access to communication channels

Attacker can gain access to data protected by cryptographic mechanisms during the transmission by using a trusted channel between the components of the system, modifying the data during their transfer in a manner undetectable by the user.

T. Disclosure of authenticated and authorized data

The authenticated and authorized data of an encrypting/decrypting entity may be disclosed. This includes interception by an attacker of data entered into the system, the use of any unattended mobile device without the use of adequate security during the operation decryption, performing incorrect operations misleading to the encryption/decryption entity, the attack using the full search method the value of authentication and authorizing or divining or as a result of unintentionally sent data to a destination other than that indicated by the original sender.

T. Modification of a set of addressed access policies

Malicious user can access in a manner allowing to add or remove one or more addressed access policies supported by the system. In the case of addition of policies the result can be correct validation of compliance with the policies invalid ciphertexts, and in the case of deletion it becomes impossible to verify the decrypted ciphertexts.

4.4

The security policy of the system This section sets out the principles of an organizational nature, applicable to the system.

Tab 4 Security Policy Supporting the MobInfoSec system

P. Data Presentation

The system must have the ability to present the entity encrypting/decrypting copy of encrypted or decrypted data and it should not be allowed to encrypt or decrypt the data if one can't present the entity or entities will not be informed.

If the decrypted data are presented, the system should not be allowed to make a copy of data that is not following the rules set out in the addressed access policies.

P. Encryption/ decryption of documents

The system must allow for the encryption/decryption of single or multiple documents. The authorization granted by the encryption and/or decryption of the multiple documents must be based on the same encryption attributes that are necessary for a single document.

P. Compatibility attributes

To prevent the creation of improper ciphertexts or the loss of confidentiality of the ciphertexts, the system must check if all encryption attributes selected by ciphertexting person are compatible with the addressed access policies.

P. Interruption of encryption/decryption

The encrypting/decrypting entity must be able to interrupt the process before activation key encryption/decryption. P. Explicit agreement from the Dispatcher and the user of a document

The system must oblige the Dispatcher/User for the implementation of a set of non-trivial operations to verify their willingness to encrypt/decrypt the document before running the proper process encryption /decryption of the document(s) P. Compliance of Certificates:

To prevent the loss of confidential data contained in ciphertexts, the system must verify that the certificates (including certificates belonging to certification path), which are used during the authentication and authorization of shadows owners , are compatible with the addressed access policies.

P. Authenticity of certificate

The system should monitor the presence and validity of the certification path between the certified decryption entity and trusted point specified in the addressed access policies

P. Validity of certificate

To prevent improper ciphertexts or loss of confidentiality of the ciphertexts, the system must verify that the certificate selected by the dispatcher has been successfully applied in the period of its validity in accordance with the addressed access policies.

P. Integrity of validation data

The system should control the user data integrity validation on mobile devices.

P. Management

The system must allow the operator to manage addressed access policies, certificates and assertions (adding and removing them).

Security Objectives the system

This section defines the security objectives that correspond to the identified assumptions and threats to the system, and support its security policy.

Table 5 The main assumptions and security objectives of MobInfoSec system

O. Management

The system must allow the dispatcher to define addressed access policies and their publication, and allow the operator to manage this addressed access policies, certificates and assertions (adding and removing them).

O. Secure communication

The system provides the opportunity to build a trusted communication channel between its components and to detect any violation.

O. Data protected in communication channel

System protects the encrypted data, authenticated encryption attributes, etc., against disclosure and modification when they are transmitted between its components.

O. Update and verification of mobile device software

System ensures that any updates to the user subsystem components and SP token must be automatically verified for their invariability and their origin.

O. Monitoring system and user application

System/user application provides the ability to generate event records for the audit and to send them on request to the administrator, operator and user.

O. Removal of resident information

System ensures that all data are permanently deleted and are not available.

O. Lock of the session

The system provides mechanisms that allow the temporary suspension of unattended user session, which can be captured and allow it to resume only after re-authentication.

O. End of the session

The system should impose a limit on the time that has elapsed between the taking by the dispatcher decision to start the encryption process and the time for calculating the value of the ciphertext. The same requirements apply to the process of decrypting the ciphertext by the user. In case of detecting the state of the system lock, the session ends. O. Authentication and authorization of the administrator, operator, etc. of the system

The system should provide the administrator, operator and user to enter their authentication and authorization data before accessing its functions and before carrying out any specific measures provided therein.

O. Integrity of services

Before the system will allow users to access the provided services, it should check their integrity and the integrity of the parameters necessary for their proper operation.

O. User's warning

The system should alert the operator encryption/decryption and allow to interrupt the process of encryption/decryption in a situation where it is impossible to present the dispatcher and the user encrypted data or the encryption attributes indicated by the identifier addressed access policies, and/or where the data encrypted or decrypted are not conform to the syntax format describing it.

O. Integrity of encrypted data

It must ensure the integrity of encrypted data formats used from the time they were formatted for the creation of the ciphertext.

O. Consent of the dispatcher/user

The system should provide the dispatcher/user mechanism enabling (on a voluntary and explicit basis) the consent to initiate the process of selecting a document or documents in order to create/decrypt the ciphertext. In addition, the system should require the dispatcher/user a non-trivial initiation of the process excluding any randomness of this decision.

O. Process interruption

The system should provide the ciphering /deciphering with the mechanism that allows it to interrupt the process of encryption/decryption before activating the appropriate key.

O. Processes protection

The system must provide protection against arbitrary interference by untrusted processes, peripheral devices and communication channels, and intruders interfering with these processes, which are used during the encryption/ decryption, and during the creation of encrypted data as indicated in the creation of ciphertext request. O. Confidentiality of data authentication and authorization:

The system must ensure the confidentiality of authentication and authorization data which belongs to the encryption/decryption entity.

O. Integrity of addressed access policies:

Before each use, the system should inspect the integrity of the addressed access policies. The system should not allow to decrypt the ciphertext if the violations of the addressed access policies integrity is detected O. Set of documents After acceptance by the dispatcher a permission to encrypt documents, the system must ensure that the processed set of documents actually corresponds exactly to selected one, and encryption attributes used must be identical for each document.

O. Starting the application

The system must run the application upon the user request to allow it to present the attributes of data encryption and decryption after the encryption, without revealing their content to third parties. If the system can't run this application, it should warn the user O.

Compliance of attributes

The system should verify compliance of used encryption attributes with the addressed access policies.

O. Compliance of validation data

The system shall verify that the validation data supplied for the purpose of decrypting the data comply with the criteria of addressed access policies.

O. Time stamping

The system should provide the ability to bind to the ciphertext with the reliable timestamp, which will allow (according to the addressed access policies) to confirm the creation of the ciphertext before a certain date. O. Validity of certificate The system must control that the certificate selected by the encryption entity is used for its intended purpose and only during the period of its validity.

O. Certification path

The system should monitor whether there is a valid certification path between the certified entity decryption and certificate of one of the selected points of trust, as defined in the addressed access policies.

O. Compliance of certificates

The system shall verify that the certificates (including certificates belonging to certification path) used during the authentication and authorization owners of shadows addressed in accordance with a given access policy.

O. Compliance of decryption key reproducibility

The system should monitor whether the process of acquiring the shadows necessary to restore the decryption key is compatible with the target site access policies.

OE. TOE configuration

TOE must be properly installed and configured so that as soon as you start passing in a safe state. TSFs implemented on mobile devices must be configured by the administrator of TOE in order to properly support the adopted TSP.

OE. Authenticity of a policy origin

Before the addressed access policy to information and their templates are approved, the operator of TOE must ensure the authenticity of their origin. OE. Access to PKI services ICT environment of the TOE must ensure access to:

certificates, assertions, and other necessary validation data; information about PKI services supporting group encryption/ decryption schemes and protocols for authentication and protection of exchanged messages; other PKI services necessary for the proper operation of the TOE (e.g. to

Fig. 1

 1 Fig.1 MobInfoSec components

  The component operates as a broker managing cryptographic service requests for the execution of service (e.g. service requests arising from the signing evidences from Dispatcher Subsystem, and Polices & Assertions Management Subsystem) and its results, or communicates with one of the two components described above.

	Cryptographic Services Server: The component generates and stores
	cryptographic keys used for authentication algorithms and data
	encryption/decryption (including threshold algorithms for keys sharing),
	assertions evidences, addressed policies templates and addressed policies.
	-Communication Module for External PKI Services: The component
	implements the functionality of interface with PKI services provided by the
	external PKI service providers.
	-Cryptographic and PKI Services:

Acknowledgment. This scientific research work is supported by National Centre for Research and Development (NCBiR) of Poland (grant No PBS1/B3/11/2012) in 2012-2015.

Table 1 The most important identified assets of the MobInfoSec system A. Document Electronic Document(s) for encryption/decryption. Data contained in this document must be protected against the loss of integrity and confidentiality.

A. Encrypted data

Includes encrypted document and document attributes. Data (ciphertext) must be protected against the loss of confidentiality and integrity.

A. Encrypted attributes

Data contained in addressed access policies and allowing to correct encrypt and decrypt the encrypted data. These attributes must be protected against the loss of integrity.

A. Addressed access policies

Defines the rules that should be used to encrypt and decrypt the data. Addressed access policy is managed by the system administrator and must be protected against the loss of integrity A. Programming components of the system Software includes executable code that implements sharing services and verification rules based on addressed access policies. This software must be protected against loss of integrity A. Users and dispatcher data for authentication and authorization Data allowing the user and the dispatcher to authenticate and authorize. The successful end of the authentication carries out the mobile device on standby to execute commands of an authenticated entity. These data must be protected against the loss of integrity and confidentiality A. Validation Data All data necessary to carry out the verification of the rights of the entity to decrypt the document. These data must be obtained from a Standard Trusted Subsystem and stored on the mobile device on which the verification is made. These data must be protected against the loss of integrity.

A. Cryptographic keys stored in the system

Cryptographic keys used by the system in order to enforce their security functions. Cryptographic keys can be present in SP module and Cryptographic Key Storage, and can be exchanged between them via a trusted channel only. These data must be protected against the loss of confidentiality A. Audit Records Records include the events that are audited. These events should be detected and recorded by the system. These data must be protected against the loss of availability

4.2

The assumption of the system This section describes the assumptions concerning MobInfoSec system security environment.

support the secure establishment of distribution channels and revocation of certificates).

The security functional requirements

To determine the security functional requirements for MobInfoSec system justifying the selection of security objectives and the relationship between these components, the requirements based on the CC [START_REF]Information technology -Security techniques -Evaluation criteria for IT security", Part 2: Security functional requirements[END_REF][START_REF]Information technology -Security techniques -Evaluation criteria for IT security[END_REF] and the trust model described in [START_REF] Fray | Method of determining the trust in the information system based on the process of assessing and treating risk[END_REF][START_REF] Fray | About some application of risk analysis and evaluation[END_REF] are used. The results of the selection of these security functional requirements are presented in Table 6.

Summary

This article provides an overview of a system for cryptographic protection of sensitive data on mobile devices, implementing the functionality resulting from the requirements of ORCON model and information mobility. It presents the most important security functional requirements imposed on this type of system working in a distributed environment. The law on protection of Sensitive Information [START_REF]Protection of sensitive information[END_REF], the most representative ISO/IEC standards [START_REF]Information technology -Security techniques -Evaluation criteria for IT security", Part 1: Introduction and general model[END_REF][START_REF]Information technology -Security techniques -Evaluation criteria for IT security[END_REF][START_REF]Protection Profile for Mobile Device Fundamentals[END_REF], all analysed attacks, especially those that use currently known vulnerabilities in mobile devices [START_REF]Fortinet's FortiGuard Labs "Reveals Newest of mobile Malware Trends in Latest Threat Report[END_REF][START_REF]Mobile threat report[END_REF], and security profiles for mobile devices [START_REF]Protection Profile for Mobile Device Fundamentals[END_REF][20][START_REF]Protection Profile for Network Devices[END_REF] were taken into account in order to accurately identify the possible threats, define the security policy and security objectives to minimize the impact of threats and support the activities stated in the security policy.


Nguyen Van Nhuong

Vo Thi

Yen Nhi

Nguyen Tan
email: tan@hcmus.edu.com

Mai Xuan Phu
email: mxphu@fit.hcmus.edu.vn

Cao Dang

Semantic set analysis for malware detection

Keywords: data mining algorithm for classification, x86 instruction set, obfuscation techniques, malware detection, semantic set

Nowadays, malware is growing rapidly through the last few years and becomes more and more sophisticated as well as dangerous. A striking malware is obfuscation malware that is very difficult to detect. This kind of malware can create new variants that are similar to original malware feature but different about code. In order to deal with such types of malware, many approaches have been proposed, however, some of these approaches are ineffective due to their limited detection range, huge overheads or manual stages. Malware detection based on signature, for example, cannot overcome the obfuscation techniques of malware. Likewise, the behavior-based methods have the natural problems of a monitoring system such as recovery costs and long-lasting detection time. In this paper, we propose a new method (semantic set method) to detect metamorphic malware effectively by using semantic set (a set of changed values of registers or variables allocated in memory when a program is executed). For more details, this semantic set is analyzed by n-gram separator and Naïve Bayes classifier to increase detection accuracy and reduce detection time. This system has been already experimented on different datasets and got the accuracy up to 98% and detection rate almost 100%.

Introduction

Today, malware is deployed up faster and faster and has a variety of spreading types.

According to the McAfee 2012 statistics [START_REF]Infographic: The State of Malware 2013[END_REF], "malware is going unabated, with no sign of slowing down", new malware samples in 2012 grew 50% annually over 2011.

McAfee catalogs covered 100,000 new malware samples every day in 2012, which means 69 new pieces of malware per minute [START_REF]Infographic: The State of Malware 2013[END_REF]. Moreover, the obfuscation techniques of malware are being developed more diversely and more complicatedly [START_REF] Rad | Camouflage in Malware: from Encryption to Metamorphism[END_REF]. New malware samples not only use one obfuscation technique but also combine more techniques, such as metamorphic malware [START_REF] Rad | Camouflage in Malware: from Encryption to Metamorphism[END_REF], which could make the difficulty to malware detection. Many malware detection methods are widely used nowadays, such as: using signature [START_REF] Sachin | Byte Level n-Gram Analysis for Malware Detection[END_REF], using data mining for classification [START_REF] Sachin | Byte Level n-Gram Analysis for Malware Detection[END_REF] or using behavior features [START_REF] Ghiasi | DyVSoR: Dynamic Malware Detection Based on Extracting Patterns fromValue Sets of Registers[END_REF]. Even though signature-based detection can easily classify malwares, the detection's scope is limited around the well-known malware. Data mining-based detection can simply recognize malware with the high accuracy but this system spends more time on both the training process and the detecting process. Moreover, malware detection based on data mining is in static detection type so it cannot categorize metamorphic malwares. Behavior-based detection is effective to defeat the obfuscation techniques; however, its extracting subsystem is too complicated to deploy. In addition, this method belongs to dynamic detection type so it itself has the natural problems of a monitoring system [START_REF] Nguyen | MAVMM: Lightweight and purpose built VMM for malware analysis[END_REF]. For instance, the silent malware is used VMM (Virtual Machine Monitor) detection techniques: IDT check, LDT check, MCW check or Virtual PC Special Instruction [START_REF] Nguyen | MAVMM: Lightweight and purpose built VMM for malware analysis[END_REF] to detect its executing environment that is whether virtual or not and then automatically changes to the appropriate behavior.

There are many studies of malware detection, but each of them has its advantages and disadvantages. A new detection method by using semantic set as a feature is proposed to recognize malware. Semantic set is a set of values changed on registers and variable allocated memories when program is executing. With the original hypothesis which explains that "Two programs are similar to each other if and only if their two semantic sets are also similar to", therefore, semantic set is an effective behavior for identifying malware. In order to get semantic set, either a monitoring system or a smart tracer tool must be used. In this paper, authors developed an automatic tracer to overcome the limitations of the monitoring system. In the proposed system, semantic set is combined with the n-gram separator and Naïve Bayes classifier to become a more precise malware detection system, which also can detect metamorphic malware. Moreover, this system will give a new perspective on malware detection method: by using the dynamic behavior interpreted by malware's code as an input for the Naïve Bayes classifier [START_REF] Sachin | Byte Level n-Gram Analysis for Malware Detection[END_REF]. This system will inherit their strong characteristics to be a stronger one.

This paper is organized into sections: Section 2 introduces the related studies in malware detection. Section 3 gives more detail technology about semantic set and its application in malware detection. Section 4 initiates the proposed system and its experimental results. Section 5 gives the conclusions and then introduces some future works.

2

Related works

From time to time, the malware obfuscation techniques become more and more complicated. Fig. 1 shows the milestone of malware's camouflages [START_REF]Infographic: The State of Malware 2013[END_REF].

No stealth 1970s

Encrypted 1987

Oligomorphic 1990

Polymorphic 1990

Metamorphic 1998

Fig. 1. The milestone of malware's camouflage.

There are three general methods in malware detection: static method, dynamic method and hybrid method.

Sachin Jain and et al. [START_REF] Sachin | Byte Level n-Gram Analysis for Malware Detection[END_REF] used n-hex byte as a signature to detect malware. Instead of using a common string matching algorithm, they used data mining for classifying malware. Classwise Document Frequency [START_REF] Sachin | Byte Level n-Gram Analysis for Malware Detection[END_REF] is proposed to filter the standard n-hex bytes. It not only reduces the space of n-hex bytes but also supplies a good input for the classifier. However, this method requires more time in the training and in the detecting process, especially on big-sized sample files or big datasets. The selected n-hex bytes can help the classifier to detect malware in the ranges: well-known malwares or simple transformable malwares. With the encrypted malware or advanced transformable malware (polymorphic malware or metamorphic malware), this method is not useful.

Without using the static detection method, Mahboobe Ghiasi and et al. [START_REF] Ghiasi | DyVSoR: Dynamic Malware Detection Based on Extracting Patterns fromValue Sets of Registers[END_REF] developed the DyVSoR system which recognizes malware by the set of registers' values. DyVSoR uses a VMware to monitor the values of some registers as EAX, EBX, ECX and EDX when the program called API/function calls. After a monitoring time, the set of register's values is considered as an input of matching-based behavior. By experimenting, this system has the accuracy up to 96%, higher than Kaspersky [START_REF] Ghiasi | DyVSoR: Dynamic Malware Detection Based on Extracting Patterns fromValue Sets of Registers[END_REF] at that time. However, DyVSoR can be hardly used widely, because the threshold of monitoring time for a sample file is still an open problem. If the monitoring time is too short, malware cannot perform its action; in contrast, if the monitoring time is too long, it could be ineffective. Besides, the restore time after the monitoring will make the system slower. With the smart malwares, they can detect executing environment by VMM detection techniques [START_REF] Nguyen | MAVMM: Lightweight and purpose built VMM for malware analysis[END_REF] and easily change to the proper behavior. They is the death weakness (transparent problem) of any monitoring system.

The dynamic method is able to detect the obfuscation techniques of malware, which static method is unable, but the dynamic method could fail in the silent malware. To resolve that problem, Nguyen Anh M. and et al. [START_REF] Nguyen | MAVMM: Lightweight and purpose built VMM for malware analysis[END_REF] propose the MAVMM (lightweight VMM) system which can detect silent malware. Authors modify the core of VMM and remove unnecessary modules to perform only one objective: to monitor malware behaviors [START_REF] Nguyen | MAVMM: Lightweight and purpose built VMM for malware analysis[END_REF]. This system steps over the problems of monitoring systems and reaches some positive results. For example, the monitoring system status is quickly restored after monitoring a sample file, the monitoring time is fixed and the system is transparent to malwares [START_REF] Nguyen | MAVMM: Lightweight and purpose built VMM for malware analysis[END_REF]. Even though there are improvements, it is difficult to deploy widely in reality. Besides that, MAVMM's system needs more supports from hardware such as the virtual technology. In addition, there are some troubles when the system removes unnecessary hardware and software modules to make it more lightweight, but some malwares need network card, SD storage or user information such as email, system information, etc., to run.

Table 1 shows the advantages and disadvantages of these analysis methods in malware detection: -Spend more cost on training or detecting process.

-Difficult to detect advanced transformable malware.

DyVSoR [START_REF] Ghiasi | DyVSoR: Dynamic Malware Detection Based on Extracting Patterns fromValue Sets of Registers[END_REF] Dynamic detection Detect malware with high accuracy, including transformable malware.

-Problem of monitoring system.

-Cannot overcome MM detection techniques.

MAVMM [3]

Advanced dynamic detection

Overcome the natural problem of monitoring system.

-Need supports from hardware and difficult to deploy in reality.

Table 1 proves that the feature based dynamic method can bypass almost all of obfuscation techniques and the static method has higher advantage in detection's time. Therefore, the malware detection method should use those techniques together to improve the accuracy and remove problems of the static and dynamic method. Based on the above ideas, authors developed a malware detection system that uses semantic set as a dynamic feature, and segments this semantic set into set of 3-gram values [START_REF] Sachin | Byte Level n-Gram Analysis for Malware Detection[END_REF] as an input for Naive Bayes algorithm to quickly identify sample files.

Our approach

Before introducing to the proposed system, some basic terms are explained:

─ Program has a collection of variables which always change their values when is executed. Those variables are loaded into registers or variable allocated memories to execute, then the change of their values are similar to the change of values on registers and variable allocated memories. ─ Set of values changed on any register or variable allocated memory is called semantic string. The set of semantic strings is called a semantic set. The semantic set contains all changed values in a program instance. In this way, the semantic set is appreciated as the dynamic feature of the program. ─ Semantic set is considered as a form of dynamic feature which can overcome the weaknesses of the traditional methods, such as hex code signature [START_REF] Sachin | Byte Level n-Gram Analysis for Malware Detection[END_REF] or API/function call signature [START_REF] Alazab | Malware detection based on structural and behavioural features of API calls[END_REF], [START_REF] Elhadi | Malware Detection Based on Hybrid Signature Behavior Application Programming Interface Call Graph[END_REF]. As the result, semantic set is used as an n-gram input of Naïve Bayes classification algorithm [START_REF] Alazab | Malware detection based on structural and behavioural features of API calls[END_REF]. So that, the similarity between two semantic sets are decided by Naïve Bayes classifier.

In order to become the input for this classifier, each semantic string is separated into the 3-gram [START_REF] Alazab | Malware detection based on structural and behavioural features of API calls[END_REF] values (a short string contains 3 values) by 3-gram separator [START_REF] Alazab | Malware detection based on structural and behavioural features of API calls[END_REF]. A set of 3-grams is often very large, therefore, it should be reduced by Classwise Document Frequency [START_REF] Alazab | Malware detection based on structural and behavioural features of API calls[END_REF] to only get the 3-gram values, namely: ─ The 3-gram values only appear in semantic set of malware or the 3-gram values do not appear in the semantic set of malware. ─ The 3-gram values appear in semantic set of malware but their probability of frequencies is very high or very low.

After experiments, 2000 3-gram values is enough to be used as a feature for Naïve Bayes algorithm. Actually, Naïve Bayes algorithm (1) uses all 3-gram value probabilities to identify a sample file:

P(𝑋|𝐶 𝑖 ) = argmaxP(𝐶 𝑖 ). ∏ P(𝑥 𝑘 |𝐶 𝑖 ) 𝑛 𝑘=1 (1)
Where X = {x1, x2, …, xn} and P(X|Ci) is the probability of sample X in class Ci and P(Ci) is the probability of class Ci (class C contains all attributes which needs classifying). Due to the property of multiplication, the total probability will be zero or very near zero if some 3-gram values' probability is zero or very near zero. It will cause the Naïve Bayes classifier become ineffective. In order to deal with this problem, Maximum Likelihood technique is used to increase the accuracy of semantic set system.

if ( MALWARE SCORE > BENIGN SCORE) File is MALWARE. else if ( BENIGN SCORE > MALWARE SCORE and BENIGN SCORE -MALWARE SCORE <= WARNING THRESHOLD)

File is WARNING. else File is BENIGN.

Because semantic set is automatically extracted by a tracer tool, so it can overcome the obfuscation techniques of malware. In the following examples, we will give the examples and sequentially analyze the non-effect obfuscation of malware to the change context of semantic set.

Assuming that, there is the original assembly language code: ;ex = -10 (15) Exit ( 16) JUMP (14) The related semantic set is: Scomplex = [dx = {0, 100} ex = {0, 1, 0, -10} cx = {90}] This semantic set will increase the number of its strings and the number of values in each semantic string but the similarity between Sorign and Scomplex is still not changed. In other words, the transformable code techniques are unlikely to be affected to the similarity between two programs if their internal processing is equivalent. The malware belonging to this group has 4 basic parts as in Fig. 2. When the program is executed, the decryption part will be executed firstly to decrypt the encryption code.

6-Code encryption.

After that, the final program will become a normal program. This technique is used by malware to evade detection and loopholes only at runtime. Therefore, the semantic set of this program will increase some semantic strings of decryption part but the semantic set similarity between original program and encrypted program remains unchanged.

7-Malware used another technique.

Some malware opens itself only during its execution. It implements functions and prepares necessary data to execute itself. A sigmoid function is prepared to activate malware's behavior and this behavior is not shown explicitly in the executable code.

One simple example:

(1) MOV [0x12345], locate_0x101; preparing code.

(

) MOV [0x22345], locate_0x102 (3) PUSH [0x1233], locate_0x103 (4) POP [0x1000] (5) JMP [0x1000]; executable code (6) JMP [0x12345] (7) JMP [0x22345] (8) JMP [0x1233] 2
In the above code, the commands (1)(4) prepare data (started address of the build-in functions) for commands (5)(8) to be executed by jump commands. The semantic set includes two parts: runtime semantic strings of malware and semantic string of the preparing code. This ensures to detect successfully this malware, otherwise method based on signature such as API/function call or hex bytes cannot do. In spite of using the same feature as DyVSoR system of Mahboobe Ghiasi [START_REF] Ghiasi | DyVSoR: Dynamic Malware Detection Based on Extracting Patterns fromValue Sets of Registers[END_REF], the proposed method has some new characteristics: ─ Instead of using a VMware system to monitor the changed values of the registers after each API/function call [START_REF] Ghiasi | DyVSoR: Dynamic Malware Detection Based on Extracting Patterns fromValue Sets of Registers[END_REF], the proposed system identifies malware based on the semantic set. The modified Pyew tool [8] is used for disassembly PE (Portable executable) file. Then, all changed values on registers and variables allocated memory will be extracted automatically into semantic set by our tracer tool. In addition, DyVSor uses VMware thus increases processing time for each sample file, but the proposed system limits it. ─ DyVSor only traces the values on basic registers, such as: EAX, EBX, ECX, and EDX [START_REF] Ghiasi | DyVSoR: Dynamic Malware Detection Based on Extracting Patterns fromValue Sets of Registers[END_REF] when the executed program calls API/function. This API/function call is limited by the set of API collected such as network API system, file system API [START_REF] Ghiasi | DyVSoR: Dynamic Malware Detection Based on Extracting Patterns fromValue Sets of Registers[END_REF]. Hence DyVSoR is not as general as malware detection system based on semantic set. For that reason, those kinds of malware using the external library with different API/function calls as OpenGL API, OpenCV API or encrypted API, etc., will not be detected correctly by DyVSoR system. ─ Besides that, DyVSoR uses string matching algorithm [START_REF] Ghiasi | DyVSoR: Dynamic Malware Detection Based on Extracting Patterns fromValue Sets of Registers[END_REF] while the semantic set system uses Naïve Bayes algorithm to classify sample files. With the long register's value string, the matching algorithm will not work as effectively as Naïve Bayes algorithm, because Naïve Bayes only uses the features extracted from the training process instead of using all semantic string. ─ In addition, the semantic set system uses the tracer (running as an interpreter) to extract the semantic set. Thus, it can control the executing of a program and easily prevent the threat action of malware without recovery time like the DyVSoR system. Moreover, the tracer is independent so it can be integrated into other systems.

In summary, the proposed system used semantic set as an input for Naïve Bayes classifier. Therefore, this system can inherit the advantages of the semantic set and Naïve Bayes filter. The system has already been experimented on common datasets and got the high accuracy.

4

Implement and experimental result

Implementation

In order to compare semantic set method with equivalent malware detection methods, the datasets which have the same ratio in number of files and type of files are used: Dataset 3 [START_REF] Sachin | Byte Level n-Gram Analysis for Malware Detection[END_REF] 107 files 51 Malware, 56 Benign Dataset 4 [START_REF] Alazab | Malware detection based on structural and behavioural features of API calls[END_REF] 79 files 18 Benign, 61 Malware Besides, those datasets are chosen because of two other reasons:

─ Firstly, the datasets include all common very dangerous and many variant malware's types such as: worm, backdoor, trojan, virus and benign files belonging to Windows32 system files. ─ Secondly, the number of samples in the datasets for the semantic set system and these methods such as API Graph [START_REF] Elhadi | Malware Detection Based on Hybrid Signature Behavior Application Programming Interface Call Graph[END_REF], DyVSoR [START_REF] Ghiasi | DyVSoR: Dynamic Malware Detection Based on Extracting Patterns fromValue Sets of Registers[END_REF], n-hex byte Naïve Bayes [START_REF] Sachin | Byte Level n-Gram Analysis for Malware Detection[END_REF] and Structure and Behavior features [START_REF] Alazab | Malware detection based on structural and behavioural features of API calls[END_REF] are similar in ratio. A list of selected malwares is shown in Table III. Detection rate TP/ (TP + FP) To evaluate the accuracy of the SSSM system, the above parameters are used (Table IV). After that, the datasets mentioned in Table III has been tested, the accuracy of malware detection system is shown in Table V: The result proves that our malware detection system has ability to detect most of malware samples in datasets. The detection rate reaches 100% and accuracy is up to approximately 98.82%.Therefore, this new method should be paid more attention to by anti-malware researchers. These precision charts reveal the detection result of our method that compares with API/function Graph, DyVSoR system, n-hex byte Naïve Bayes and Structure and Behavior feature system. In addition, the system is able to detect some kinds of malware that are difficult to others. For example, Backdoor.ASP.Agent and Backdoor.PHP.Ace are two malwares that cannot extract API/function call list. As a result, API Graph method [START_REF] Elhadi | Malware Detection Based on Hybrid Signature Behavior Application Programming Interface Call Graph[END_REF] cannot be used for them, but semantic set system is able. Moreover, the system can detect the complicated malware as: Worm.Win32.Downloader which has many variations.

Conclusion

Today, malwares are deployed faster and faster and their metamorphosis is more and more complicated. Nevertheless, the current detection methods together with some advantages are still limited, so an effective method to classify malware and to be able to overcome the limitations of the current methods becomes more demanded. We propose a new method for malware detection that combines semantic set as a dynamic feature with Naïve Bayes classifier to increase detection accuracy. In addition, the simulating and extracting the malware behavior by our tracer tool help the detection

Semantic set system

Structure and Behavior feautures Accuracy system reduce the detection time and get rid of the effect of malware behavior to system. Further, our system was experimented on different datasets and gained highly accuracy, which provides a new aspect for anti-malware researchers.

In order to improve the accuracy and realize the semantic set system, some future works are listed:

1. Integrate semantic set with other methods to create a new malware detection that can detect malware on a large scale and high precision. 2. Improve system's performance by combining between parallel CPU and GPU programming in order to build a real-time system for malware detection. 3. Develop tracer tool to be a debugger that extracts values on registers and variable allocated memories more and more exactly and therefore increases the reliability and exactness of malware detection system.

Fig. 2 .

 2 Fig. 2. Diagram of malware detection based on semantic set. The modified Naïve Bayes algorithm classifies a sample file by giving two values: the MALWARE SCORE (the similarity probability between sample file and malware file) and the BENIGN SCORE (the similarity probability between sample file and benign file). The decision function is shown in the following pseudo code:

  ADD cx, dx, ex ;cx = dx + ex = 100 -10 = 90 (13) GOTO Exit (14) ADD ex, -10

Fig. 3 .

 3 Fig. 3. Diagram of malware encryption.

Fig. 4 .

 4 Fig. 4. The detection rate of semantic set system and API Graph system.

Fig. 5 .

 5 Fig. 5. The accuracy of semantic set system and DyVSor system.

Fig. 6 .

 6 Fig. 6. The accuracy of semantic set system and n-hex byte Naïve Bayes.

Fig. 7 .

 7 Fig. 7. The accuracy of semantic set system and Structure and Behavior features system.

TABLE I .

 I COMPARISON OF MALWARE DETECTION SYSTEM.

	Method	Type	Advantage	Disadvantage
	3-gram hex	Static	Quickly recognize
	bytes	and	detection	familiar malware.
	Naïve Bayes
	[4]

TABLE III .

 III CLASIFICATION OF SAMPLE'S TYPE IN EACH DATASET.

		No.	Name of sample file	Classification
		1	P2P-Worm-Win32.Agent	Worm
		2	Backdoor.ASP.Ace	Backdoor
		3	Backdoor.PHP.Agent	Backdoor
		4	Trojan.Win32.KillFiles	Trojan
		5	Virus.Win32.Delf	Virus
		6	Virus.Win32.Seppuku	Virus
		7	Worm.Win32.Downloader	Worm
		8	Worm.Win32.Viking	Worm
		9	System32 folder	Benign
	4.2	Experimental result

TABLE IV .

 IV THE EVALUATION PARAMETERS TABLE.

	No.	Parameter	Meaning
	1	TP	The amount of malware files are recognized as malware.
	2	FP	The amount of benign files are recognized as malware.
	3	TN	The amount of benign files are recognized as benign.
	4	FN	The amount of malware files are recognized as benign.
	5	Accuracy	(TN+TP)/(TN+TP+FN+FP)
	6

TABLE V .

 V DETECTION RESULT OF MALWARE DETECTION SYSTEM BASED ON SEMANTIC SET.

	Dataset	Evaluation	Accuracy	Detection
				rate
	1	TN = 9, FN = 1, TP = 75, FP = 0	98.82%	100%
	2	TN = 49, FN = 6, TP = 100, FP = 0	96.12%	100%
	3	TN = 50, FN = 6, TP = 51, FP = 0	94.39%	100%
	4	TN = 17, FN =1, TP = 61, FP = 0	98.73%	100%

(1) e6 XOR ax, 0

;ax = 0 (2) 2069 6e XOR bx, 0 ;bx = 0 (3) 206d 6f ADD ax, 100 ;ax = 100 (4) 2e 0d SUB bx, 10 ;bx = -10 (5) 64 65 2e ADD cx, ax, bx ;cx = ax + bx = 90

The original semantic set is:

In turn, the equivalent transform of the semantic set is shown through the following obfuscation techniques (in bold lines): 1-Garbage code insertion.

(

2-Garbage function or unused function insertion.

Garbage function or unused function insertion actually uses garbage code insertion but with a larger scale. Thanks to the above definition of semantic set, this obfuscation technique is still not affected to the original semantic set.

( The Sfgarbage becomes much larger than Sorigin but the "shadows" of Sorigin (bold instruction) still appears in Sfgarbage. So Sorigin and Sfgarbage are also similar.

3-JUMP insertion and register renaming.

4-Equivalent code replacement:

(1) AND ax, 0 ;ax = 0 (2) AND bx, 0

;bx = 0 (3) ADD ax, 1

;ax = 100 (4) MUL ax, ax, 100

;ax = ax*100 = 1*100 = 100 (5) ADD bx, -10

;bx = bx -10 = 0-10 = -10 (6) ADD cx, ax, bx ;cx = ax + bx = 100 -10 = 90 Hence, the semantic set is: Sequi = [ax = {0, 100} bx = {0, -10} cx = {90}] Sequi is similar to Sorigin. Consequently, the equivalent code replacement technique is still not affected to the semantic set. This is a special feature, which traditional method cannot perform.

5-Combine many obfuscation techniques.

(1) XOR dx, 0 ;dx = 0 (2) NOP (3) JUMP [START_REF] Alazab | Malware detection based on structural and behavioural features of API calls[END_REF]