一种基于综合行为特征的恶意代码识别方法  

A Malicious Code Detection Method Based on Integrated Behavior Characterization

作　　者：刘巍伟[1] 石勇[1] 郭煜[1] 韩臻[1] 沈昌祥[2] 

机构地区：[1]北京交通大学计算机与信息技术学院,北京100044 [2]北京工业大学,北京100124

出　　处：《电子学报》2009年第4期696-700,共5页Acta Electronica Sinica

基　　金：国家863高技术研究发展计划(No.2007AA01Z410,2007AA01Z177)

摘　　要：基于行为的分析方法是恶意代码检测技术的发展方向,但现有的以孤立行为特征为依据的恶意代码识别方法误报率较高,本文提出了一种基于代码综合行为特征的恶意代码检测方法—IBC-DA.该算法通过改造的攻击树模型描述恶意代码执行过程中各相关主体间的关系,在此基础上计算得到的恶意性权值能够更加准确地反映代码执行过程对系统的影响.实验表明,利用本文算法进行病毒检测具有较低漏报率和误报率,并对未知恶意代码的防范具有积极意义.The existing malicious code detection algorithms which are based on individual behaviors have some drawbacks. In this paper we present a new malicious code detection algorithm based on behavior characteristics by importing improved attack tree model to describe the entity relationships during the malicious code execution time. It is named IBC-DA. The experiments result shows that the proposed algorithm works in most cases of detection and only has minor errors in few conditions. This algorithm has very oositive sense for unknown malicious code detection.

关 键 词：行为特征 攻击树 恶意代码 病毒检测 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]