基于代码覆盖的恶意代码多路径分析方法  

Exploring Multiple Execution Paths for Malware Analysis Based on Coverage of Codes

作　　者：王祥根[1,2] 司端锋[2] 冯登国[2] 苏璞睿[2] 

机构地区：[1]中国科学技术大学电子工程与信息科学系,安徽合肥230027 [2]中国科学院软件研究所信息安全国家重点实验室,北京100190

出　　处：《电子学报》2009年第4期701-705,共5页Acta Electronica Sinica

基　　金：国家自然科学基金(No.60703076);国家863高技术研究发展计划(No.2006AA01Z412;No.2007AA01Z451)

摘　　要：传统的恶意代码动态分析每次分析的对象只是恶意代码的某一个执行路径,难以保证分析的全面性.恶意代码多路径分析是解决该问题的思路之一.本文提出一种基于代码覆盖的多路径分析方法,通过标识判断条件节点,减少局部路径被重复遍历的次数,在保证分析效果的同时,提高分析系统的分析效率以及代码覆盖率.通过对大量典型恶意代码的分析验证表明,本方法可明显缩短分析时间,提高分析效率和分析的全面性.Currently, the problem of dynamic analysis of malicious code （or malware） is that only a single execution path is observed. It is potential to miss a significant fraction of the behavior that a program might exhibit under varying circumstances. To mitigate this problem, a number of analysis tools by way of exploring multiple execution paths have been proposed.In this paper, we propose a system by exploring multiple execution paths for malware analysis based on coverage of codes that can reduce the times of some paths explored and improve the analysis efficiency and increase the coverage of the malware by way of labeling control flow decision points （ branching points）. We evaluated our system on a large number of typical malware samples and demonstrate that we are able to reduce the time of analysis and improve the efficiency of analysis and increase the code coverage.

关 键 词：恶意代码 动态分析 多路径遍历 代码覆盖 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]