基于结构化指纹的恶意代码变种分析  

Analysis of malicious code variants based on structural fingerprints

作　　者：魏强[1] 金然[1] 王清贤[1] 

机构地区：[1]解放军信息工程大学信息工程学院,郑州450002

出　　处：《计算机应用研究》2008年第3期899-902,共4页Application Research of Computers

基　　金：国家"863"计划资助项目(2003AA146010)

摘　　要：提出了一种基于结构化指纹的静态分析模型,用于辅助逆向工作者对恶意代码及其变种进行分析。该方法依据所提取的恶意代码及其变种的结构化指纹特征,在调用图和控制流图两个层次对两个文件进行同构比较,找出发生改变的函数以及发生改变的基本块,从而帮助逆向工作者迅速定位和发现恶意代码及其变种的不同之处,便于进一步分析。该模型采用了结构化特征及素数乘积等方法,可以较好地对抗一些常见的代码迷惑手段,从而识别出一些变形的代码是等价的。This paper presented a new static analysis model based on structural fingerprints to help reversing engineers analysing malicious code and its variant. Using structural fingerprints extracted from malicious code and its variant, this model carried on isomorphism of call graph and control flow graph to find changed functions and basic blocks, which gave enough information for the reversing engineers quickly locating the difference between the two files to do advanced research. Since using structural character and prime product, the model would not be confused by common methods of code obfuscation and could identify that some polymorphic codes were equivalent.

关 键 词：恶意代码 变种分析 结构化指纹 静态分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]