SOLUTION FOR A SOURCE CODE-LESS SOFTWARE INFORMATION SECURITY ASSESSMENT
NIKOLAY N. SAMARIN, NIKOLAY N. SAMARIN · H&ES Research · 2021
Introduction: Digitalisation affects all sectors of human activity, resulting in the creation of a variety of software that implements business logic and technical processes in complex systems. Under these conditions, the issue of identifying malware becomes even more important. The solution to this problem is complicated by the lack of source code and the need to quickly make a decision on the presence or absence of malicious functionality. Research Aim: The aim of the research is to create an approach to assess the information security of software without source code. It is proposed that the approach is based on the use of a hypervisor that provides control over the operation of software with memory as a key characteristic of the presence/absence of its malicious functionality. It is proposed to calculate a software security score as a security metric. Methods: the solution of the set issue is based on the use of virtualization mechanism providing control over all operations over the memory realized by the software and on the use of probability theory methods to get a complex security estimate which takes into account the reliability of the software functioning and its security. Results: the methodology of getting a complex estimation of software functioning security is developed which takes into account the security of software functioning; network security — vulnerabilities and network ports detected by scanning; potentially insecure changes in file system and register and also potentially dangerous operations connected with the use of memory. The architecture of the software prototype that implements the proposed approach is described and its experimental testing is carried out, as a result of which only regular software samples received high security assessment. Practical significance: the developed system can be used for automated analysis of software operating in various complex systems. An important advantage of the software prototype is its scalability and trustworthiness ensured through the use of virtualization tools that do not allow damaging the work of a computer system in case of detection of malicious software.