quark-rules.github.io/index.html at main · ev-flow/quark-rules.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218


<!DOCTYPE html>
<html class="writer-html5" lang="en" data-content_root="./">
<head>
  <meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" />

  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  <title>Add Rules &mdash; quark-rules v26.1.1 documentation</title>
      <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=b86133f3" />
      <link rel="stylesheet" type="text/css" href="_static/css/theme.css?v=9edc463e" />


      <script src="_static/jquery.js?v=5d32c60e"></script>
      <script src="_static/_sphinx_javascript_frameworks_compat.js?v=2cd50e6c"></script>
      <script src="_static/documentation_options.js?v=55dbfdaa"></script>
      <script src="_static/doctools.js?v=9bcbadda"></script>
      <script src="_static/sphinx_highlight.js?v=dc90522c"></script>
    <script src="_static/js/theme.js"></script>
    <link rel="index" title="Index" href="genindex.html" />
    <link rel="search" title="Search" href="search.html" />
</head>

<body class="wy-body-for-nav">
  <div class="wy-grid-for-nav">
    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
      <div class="wy-side-scroll">
        <div class="wy-side-nav-search" >


          <a href="#" class="icon icon-home">
            quark-rules
              <img src="_static/quark-logo.png" class="logo" alt="Logo"/>
          </a>
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
    <input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>
        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
              <!-- Local TOC -->
              <div class="local-toc"><ul>
<li><a class="reference internal" href="#">Add Rules</a></li>
</ul>
</div>
        </div>
      </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="#">quark-rules</a>
      </nav>

      <div class="wy-nav-content">
        <div class="rst-content">
          <div role="navigation" aria-label="Page navigation">
  <ul class="wy-breadcrumbs">
      <li><a href="#" class="icon icon-home" aria-label="Home"></a></li>
      <li class="breadcrumb-item active">Add Rules</li>
      <li class="wy-breadcrumbs-aside">
            <a href="_sources/index.rst.txt" rel="nofollow"> View page source</a>
      </li>
  </ul>
  <hr/>
</div>
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">

  <section id="add-rules">
<h1>Add Rules<a class="headerlink" href="#add-rules" title="Link to this heading"></a></h1>
<p>Android malware analysis engine is not a new story. Every antivirus company has
their own secrets to build it. With curiosity, we develop a malware scoring
system from the perspective of Taiwan Criminal Law in an easy but solid way.</p>
<p>We have an order theory of criminal which explains stages of committing a crime.
For example, crime of murder consists of five stages, they are determined,
conspiracy, preparation, start and practice. The latter the stage the more
we’re sure that the crime is practiced.</p>
<p>According to the above principle, we developed our order theory of android
malware. We develop five stages to see if the malicious activity is being
practiced. They are</p>
<blockquote>
<div><ol class="arabic simple">
<li><p>Permission requested.</p></li>
<li><p>Native API call.</p></li>
<li><p>Certain combination of native API.</p></li>
<li><p>Calling sequence of native API.</p></li>
<li><p>APIs that handle the same register.</p></li>
</ol>
</div></blockquote>
<p>We not only define malicious activities and their stages but also develop
weights and thresholds for calculating the threat level of a malware.</p>
<p>But before we explain how to set weights and thresholds, we need to define
crimes and corresponding five stages.</p>
<p>An example of defining crime “Send Location via SMS” is shown below. We use
json format to construct the rule of the crime.</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="linenos"> 1</span><span class="p">{</span>
<span class="linenos"> 2</span>     <span class="s2">&quot;crime&quot;</span><span class="p">:</span> <span class="s2">&quot;Send Location via SMS&quot;</span><span class="p">,</span>
<span class="linenos"> 3</span>
<span class="linenos"> 4</span>     <span class="s2">&quot;permission&quot;</span><span class="p">:</span> <span class="p">[</span>
<span class="linenos"> 5</span>         <span class="s2">&quot;android.permission.SEND_SMS&quot;</span><span class="p">,</span>
<span class="linenos"> 6</span>         <span class="s2">&quot;android.permission.ACCESS_COARSE_LOCATION&quot;</span><span class="p">,</span>
<span class="linenos"> 7</span>         <span class="s2">&quot;android.permission.ACCESS_FINE_LOCATION&quot;</span>
<span class="linenos"> 8</span>     <span class="p">],</span>
<span class="linenos"> 9</span>
<span class="linenos">10</span>     <span class="s2">&quot;api&quot;</span><span class="p">:</span> <span class="p">[</span>
<span class="linenos">11</span>     <span class="p">{</span>
<span class="linenos">12</span>         <span class="s2">&quot;class&quot;</span><span class="p">:</span> <span class="s2">&quot;Landroid/telephony/TelephonyManager&quot;</span><span class="p">,</span>
<span class="linenos">13</span>         <span class="s2">&quot;method&quot;</span><span class="p">:</span> <span class="s2">&quot;getCellLocation&quot;</span><span class="p">,</span>
<span class="linenos">14</span>         <span class="s2">&quot;descriptor&quot;</span><span class="p">:</span> <span class="s2">&quot;()Landroid/telephony/CellLocation;&quot;</span>
<span class="linenos">15</span>     <span class="p">},</span>
<span class="linenos">16</span>     <span class="p">{</span>
<span class="linenos">17</span>         <span class="s2">&quot;class&quot;</span><span class="p">:</span> <span class="s2">&quot;Landroid/telephony/SmsManager&quot;</span><span class="p">,</span>
<span class="linenos">18</span>         <span class="s2">&quot;method&quot;</span><span class="p">:</span> <span class="s2">&quot;sendTextMessage&quot;</span><span class="p">,</span>
<span class="linenos">19</span>         <span class="s2">&quot;descriptor&quot;</span><span class="p">:</span> <span class="s2">&quot;(Ljava/lang/String; Ljava/lang/String; Ljava/lang/String; Landroid/app/PendingIntent; Landroid/app/PendingIntent;)V&quot;</span>
<span class="linenos">20</span>     <span class="p">}</span>
<span class="linenos">21</span>     <span class="p">],</span>
<span class="linenos">22</span>
<span class="linenos">23</span>     <span class="s2">&quot;score&quot;</span><span class="p">:</span> <span class="mi">4</span>
<span class="linenos">24</span><span class="p">}</span>
</pre></div>
</div>
<p>So let me walk you through the json file.</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="s2">&quot;crime&quot;</span><span class="p">:</span> <span class="s2">&quot;Send Location via SMS&quot;</span>
</pre></div>
</div>
<p>First, we define the crime. Our principle of constructing a crime is
<code class="docutils literal notranslate"><span class="pre">Action</span> <span class="pre">+</span> <span class="pre">Target</span></code>. In this example, the action is “Send SMS” and the target
is Location info. Therefore, the crime of our first rule is defined as:
“Send Location via SMS”.</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="s2">&quot;permission&quot;</span><span class="p">:</span> <span class="p">[</span>
      <span class="s2">&quot;android.permission.SEND_SMS&quot;</span><span class="p">,</span>
      <span class="s2">&quot;android.permission.ACCESS_COARSE_LOCATION&quot;</span><span class="p">,</span>
      <span class="s2">&quot;android.permission.ACCESS_FINE_LOCATION&quot;</span>
<span class="p">]</span>
</pre></div>
</div>
<p><code class="docutils literal notranslate"><span class="pre">permission</span></code> is where we fill in permission requested by the apk to
practice the crime. For instance, we need permission
<code class="docutils literal notranslate"><span class="pre">android.permission.SEND_SMS</span></code> to send information through SMS. We also need
permission <code class="docutils literal notranslate"><span class="pre">android.permission.ACCESS_COARSE_LOCATION</span></code> and
<code class="docutils literal notranslate"><span class="pre">android.permission.ACCESS_FINE_LOCATION</span></code> to practice the crime.</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="s2">&quot;api&quot;</span><span class="p">:</span> <span class="p">[</span>
    <span class="p">{</span>
        <span class="s2">&quot;class&quot;</span><span class="p">:</span> <span class="s2">&quot;Landroid/telephony/TelephonyManager&quot;</span><span class="p">,</span>
        <span class="s2">&quot;method&quot;</span><span class="p">:</span> <span class="s2">&quot;getCellLocation&quot;</span><span class="p">,</span>
        <span class="s2">&quot;descriptor&quot;</span><span class="p">:</span> <span class="s2">&quot;()Landroid/telephony/CellLocation;&quot;</span>
    <span class="p">},</span>
    <span class="p">{</span>
        <span class="s2">&quot;class&quot;</span><span class="p">:</span> <span class="s2">&quot;Landroid/telephony/SmsManager&quot;</span><span class="p">,</span>
        <span class="s2">&quot;method&quot;</span><span class="p">:</span> <span class="s2">&quot;sendTextMessage&quot;</span><span class="p">,</span>
        <span class="s2">&quot;descriptor&quot;</span><span class="p">:</span> <span class="s2">&quot;(Ljava/lang/String; Ljava/lang/String; Ljava/lang/String; Landroid/app/PendingIntent; Landroid/app/PendingIntent;)V&quot;</span>
    <span class="p">}</span>
<span class="p">]</span>
</pre></div>
</div>
<p><code class="docutils literal notranslate"><span class="pre">api</span></code> means this field can be used to practice analysis from
stage 2 to stage 4.</p>
<p>In stage 2, we need to find key native APIs that do
the <code class="docutils literal notranslate"><span class="pre">Action</span></code> and <code class="docutils literal notranslate"><span class="pre">Target</span></code>. And since the API method name can be used by
self-defined class. We need to fill in information of both the native
API class name and method name.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>We like to keep our crime/rule simple. So do not fill in more than 2 native APIs.</p>
</div>
<p>In stage 3, we will find the combination of the native APIs we define
in stage 2. Further, we will check whether they’re called in the same method.
If so, we will say that the combination of crime is caught!
And we don’t need to do anything to adjust the <code class="docutils literal notranslate"><span class="pre">api</span></code> field.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>We know that the native API might be wrapped in other methods. We use XREF to solve this problem.</p>
</div>
<p>In stage 4, we will find whether the native APIs are called in a right sequence.
If so, we have more confidence that the crime is practiced.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Please place the APIs in the order as the crime is being committed.</p>
</div>
<p>In stage 5, we will check whether the native APIs are operating the same parameter.
If so, we are 100% sure that the crime is practiced.</p>
<p>As for the field <code class="docutils literal notranslate"><span class="pre">score</span></code>, we will be updating our principles of weight defining.
please check that part later.</p>
</section>


           </div>
          </div>
          <footer>

  <hr/>

  <div role="contentinfo">
    <p>&#169; Copyright Quark-Engine Team.</p>
  </div>

  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
    provided by <a href="https://readthedocs.org">Read the Docs</a>.


</footer>
        </div>
      </div>
    </section>
  </div>
  <script>
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

</body>
</html>