基于行为特征的恶意代码检测方法  

Malicious code detection Method Based on Behavior Character

作　　者：许敏[1] 赵天福[1] 

机构地区：[1]江南计算技术研究所,无锡214083

出　　处：《网络与信息》2009年第6期14-16,共3页Network & Information

摘　　要：本文分析总结了恶意代码的行为特征,提出了一种分析API序列来检测恶意代码的方法。该方法在传统攻击树模型中添加了时间、参数调用等语义相关信息,提升了攻击树模型对代码行为的描述能力,并对恶意代码中常见的危险API调用序列进行建模。通过虚拟执行的方法获取代码的API调用序列,并将这些序列与扩展模型进行模式匹配,发现代码中的恶意行为,计算其威胁指数,进而检测代码是否具有恶意性。The essay discusses the behavior character of malicious code and a malicious code detection method based on the analyses of API sequences is presented. This method adds some semantic information, such as time, parameters and so on to the traditional model of attack tree, which strengthens the description ability of the attack tree to the behavior of the code. Further more, a model is designed to describe the sequences of threatening system calls that malicious code commonly used. By pattern matching between the call sequences of the code obtained by virtual execution and the model, we can find the malicious behavior sequences of the code, calculate the thread value and estimate the malicious property.

关 键 词：恶意代码 行为特征 检测 API调用 相关信息 参数调用 模式匹配 扩展模型 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP334.8[自动化与计算机技术—计算机科学与技术]