Network Working Group seak Internet-Draft Kang. sandy Intended status: Standards Track Antiy Labs Expires: January 13, 2009 July 12, 2008 AntiVirus Markup Language(AVML) draft-malware-avml-01.txt Status of this Memo By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on January 13, 2009. seak & sandy Expires January 13, 2009 [Page 1] Internet-Draft AntiVirus Markup Language(AVML) July 2008 Abstract This document describes the AntiVirus Markup Language(AVML). AVML is common standards language for storage, interaction and statistics of malicious software information. Malware information described by AVML More easily is dealt in distributed system. At the same time, people can read it . This document defines the AVML and explains the elements in AVML. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Requirenments . . . . . . . . . . . . . . . . . . . . . . 3 1.2. Goals . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.3. The Role of AVML on the Web . . . . . . . . . . . . . . . 3 2. AVML Fundamentals . . . . . . . . . . . . . . . . . . . . . . 4 2.1. AVML Overview . . . . . . . . . . . . . . . . . . . . . . 4 2.2. AVML Examples . . . . . . . . . . . . . . . . . . . . . . 4 2.3. AVML Syntax and Grammar . . . . . . . . . . . . . . . . . 5 3. AVML Element . . . . . . . . . . . . . . . . . . . . . . . . . 6 3.1. Malware Source . . . . . . . . . . . . . . . . . . . . . . 6 3.2. Malware File Information . . . . . . . . . . . . . . . . . 6 3.3. Virus information . . . . . . . . . . . . . . . . . . . . 8 3.4. Malware behavior elements . . . . . . . . . . . . . . . . 8 4. Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 4.1. schema of AVML . . . . . . . . . . . . . . . . . . . . . . 10 5. Security Considerations . . . . . . . . . . . . . . . . . . . 16 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17 7. Informative References . . . . . . . . . . . . . . . . . . . . 18 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 19 Intellectual Property and Copyright Statements . . . . . . . . . . 20 seak & sandy Expires January 13, 2009 [Page 2] Internet-Draft AntiVirus Markup Language(AVML) July 2008 1. Introduction 1.1. Requirenments The number and types of malicious software increased dramatically [ksb2007].Interaction of malware Information becomes very difficult. Different anti-virus vendors can not share the information, html format of the malware analysis report is difficult to deal by program. we need a unified information-description language for large-scale network malware warning, defense and analysis. 1.2. Goals In order to meet the diverse needs of the large-scale network environment virus information extraction, exchange, AVML has been designed with the following ultimate goals in mind. plain text displays descript a almost Virus Information easily read by program and human Facilitate the process of the Scientific statistics Scalability 1.3. The Role of AVML on the Web AVML can be used to collect malware information from large Heterogeneous terminal.Through these information, the Central may carry out large-scale comprehensive early warning, defense, disposal. seak & sandy Expires January 13, 2009 [Page 3] Internet-Draft AntiVirus Markup Language(AVML) July 2008 2. AVML Fundamentals 2.1. AVML Overview Antivirus Markup Languag(AVML) is an application of XML, it is used to descript malware information in distributed system. 2.2. AVML Examples see example, 54ee11ec3aa13846d95314b6fea400fc Binary File 63928 848a0fe121f1ff0c06a1cd8ef30a230e YES 2007-04-06 08:21
.text 0x400 0xB200 0x1000 0xB200 .rdata 0xB600 0x1400 0xD000 0x1370 .data 0xCA00 0x200 0xF000 0x1804
seak & sandy Expires January 13, 2009 [Page 4] Internet-Draft AntiVirus Markup Language(AVML) July 2008 ntoskrnl.exe strlen strrchr RtlUnicodeStringToAnsiString ZwQueryValueKey RtlInitUnicodeString HAL.dll ExReleaseFastMutex KeGetCurrentIrql KfRaiseIrql KfLowerIrql ExAcquireFastMutex DOS Program PE Program Backdoor.IRC.Elkcro In this example, AVML root element is VxSample. Only some file information in this AVML file The elements are define in AVML schema see Appendix. 2.3. AVML Syntax and Grammar AVML is an application of XML, or Extensible Markup Language, and as such, its syntax is governed by the rules of XML syntax, and its grammar is in part specified by a schema. In other words, the details of using tags, attributes, entity references and so on are defined in the XML language specification, and the details about AVML element and attribute names, which elements can nested inside each other, and so on are specified in the AVML schema. seak & sandy Expires January 13, 2009 [Page 5] Internet-Draft AntiVirus Markup Language(AVML) July 2008 3. AVML Element this section gives some element meaning in AVML. the all element see AVML schema in Appendix 3.1. Malware Source malware comes from different way such as antivirus software user upload or captured by honeypot.Through these information, Anti-virus organizations can forecast the outbreak trends of malware and trace it's source. SourceList: Malware Sample Source List. Source Type:Source Type include User upload, honey pot, Antivirus company,sample exchange. Priority: Upload Priority. on behalf of this channel reported priority. Note: a sample depends on the priority of all priorities inside channel reported that a maximum. FileNameList: Sample file name list FileName: Sample file name AttackIPList: Attack ip list DateTimeFirst: Attack Start Time DateTimeLast: Attack End Time IPAddr: Attack Ip Address RepeatCount: Attack Count AttackWay: Attack Way . 3.2. Malware File Information AVML File Information elements are about malware file basic informatin,struct information and some Heuristic information File Format : Such as Bin DOS PE CompilerInfo : Compiler Infomation FileSize : File Size seak & sandy Expires January 13, 2009 [Page 6] Internet-Draft AntiVirus Markup Language(AVML) July 2008 MD5 : MD5 CRC32 : CRC32 SHA1 : SHA1 CreateTimeFile : File Create Time ModifytimeFile : File Modify Time Package : Package name ShellInfor : Shell name PEStructPE : File Struct information DigitalSignatur : eexist digital signature LinkTime : PE File Link Time ImportTable : Import Table Information DLL : Dynamic-link library API : API name section : Section RawOffset : Section raw offset RawSize : Secion Raw Size VirtualOffset : Secion Virtual Offset VirtualSize : Secion VirtualSize URL : File contain URL Infomation FileDetails : File Detail information OriginalFilename: Original Filename FileDescription : File Description ProductName : Product Name InternalName : Internal Name seak & sandy Expires January 13, 2009 [Page 7] Internet-Draft AntiVirus Markup Language(AVML) July 2008 CompanyName : Company Name LegalCopyright : LegalCopyright ProductVersion : Product Version FileVersion : File Version ImageBase : PE Image Base EntryPoint : program Entry Point VCS: Heuristic characteristic signs 3.3. Virus information VirusInfo: Virus Information AVEngine: Antivirus scan engine VirusName : Virus Name ScanTime: Scan Time 3.4. Malware behavior elements Behavior : malware event list . Event: malware change system event. EventType: net file rigister process memory etc Who: malware process or dll module or other som active Path: file path register path Act: create, modify, delete etc Status: success failure etc Detail: some other information seak & sandy Expires January 13, 2009 [Page 8] Internet-Draft AntiVirus Markup Language(AVML) July 2008 See malware behavior AVML example follow: FILE xx.exe Systme32%\atielf.dat CREATE SUCESS RIGISTER xx.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft \Windows NT\CurrentVersion\Image File Execution Options\aver.exe CREATE SUCESS ...... . seak & sandy Expires January 13, 2009 [Page 9] Internet-Draft AntiVirus Markup Language(AVML) July 2008 4. Appendix 4.1. schema of AVML avml schema seak & sandy Expires January 13, 2009 [Page 10] Internet-Draft AntiVirus Markup Language(AVML) July 2008 seak & sandy Expires January 13, 2009 [Page 11] Internet-Draft AntiVirus Markup Language(AVML) July 2008 seak & sandy Expires January 13, 2009 [Page 12] Internet-Draft AntiVirus Markup Language(AVML) July 2008 seak & sandy Expires January 13, 2009 [Page 13] Internet-Draft AntiVirus Markup Language(AVML) July 2008 seak & sandy Expires January 13, 2009 [Page 14] Internet-Draft AntiVirus Markup Language(AVML) July 2008 the elements are define in AVML schema can be add in seak & sandy Expires January 13, 2009 [Page 15] Internet-Draft AntiVirus Markup Language(AVML) July 2008 5. Security Considerations None. seak & sandy Expires January 13, 2009 [Page 16] Internet-Draft AntiVirus Markup Language(AVML) July 2008 6. IANA Considerations This document has no actions for IANA seak & sandy Expires January 13, 2009 [Page 17] Internet-Draft AntiVirus Markup Language(AVML) July 2008 7. Informative References [ksb2007] "Kaspersky Security Bulletin 2007: Malware evolution in 2007", Feb 2008. seak & sandy Expires January 13, 2009 [Page 18] Internet-Draft AntiVirus Markup Language(AVML) July 2008 Authors' Addresses seak Antiy Labs Email: seak@antiy.net sandy Antiy Labs Email: kangkang@antiy.net seak & sandy Expires January 13, 2009 [Page 19] Internet-Draft AntiVirus Markup Language(AVML) July 2008 Full Copyright Statement Copyright (C) The IETF Trust (2008). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Intellectual Property The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. seak & sandy Expires January 13, 2009 [Page 20]