消除病毒变形的零转换技术  

Technology named zeroing transformation of eliminating polymorph of virus

作　　者：秦晓倩[1] 

机构地区：[1]淮阴师范学院地理系,江苏淮安223300

出　　处：《计算机工程与设计》2009年第4期893-896,共4页Computer Engineering and Design

基　　金：国家"十五""211工程"重点学科建设基金项目(181070H901);江苏省科技厅基金项目(2005101SBRB231)

摘　　要：计算机病毒变形技术的出现产生了大量的变形病毒,传统的病毒检测系统在变形病毒检测方面不尽人意。针对该现象,提出了一种消除病毒变形的零转换技术,其中包括消除病毒变形技术常用的垃圾代码的插入、变量重命名、等价语句替换、跳转指令的利用和语句重排等变形转换方法。实验结果表明,该技术能从很大程度上降低病毒变形的个数,程序语句可能出现的平均转换形式个数从转换前的1043降低到108,达到了提高病毒检测系统性能的目的。The polymorphic technology of computer virus produces a great deal ofpolymorphic virus. There are still some limitations in traditional virus detection systems, such as polymorphic virus detection. Aiming at the phenomenon, a new technology named zeroing transformation is put forward, which includes eliminating the morphing transformations used frequently by the polymorphic technology of computer virus. The morphing transformations comprises dead code insertion, variable renaming, expression reshaping, break and join transformations and statement reordering. The experiment proves that the technology can reduce the amount ofpolymorphs of virus by a long way. The average number of the procedure sentences＇s transformational shape reduces from ten power forty three to ten power eight. The technology improves the performance of virus detection system certainly.

关 键 词：病毒检测 变形病毒 变形转换 变形转换器 零转换 串表达式 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]