应用专家系统开发Windows恶意代码检测系统的研究  

Development of Windows Malware Detection System Based on Expert System

作　　者：周瑞丽[1] 潘剑锋[1] 谭小彬[1] 奚宏生[1] 

机构地区：[1]中国科学技术大学自动化系,安徽合肥230027

出　　处：《信息安全与通信保密》2009年第9期77-79,82,共4页Information Security and Communications Privacy

基　　金："863"计划(2006AA01Z449)资助

摘　　要：传统的基于特征的恶意代码检测方法无法检测未知恶意代码以及一些采用加壳等规避技术的恶意代码。为克服这些缺点,文章提出了基于专家系统的启发式检测方法。该方法可以检测采用了底层技术的恶意代码,如rootkit,以及加过壳或加过密的恶意代码,而且其检测率比一些知名的反病毒工具的检测率要高。Traditional signature-based malware detection method is not able to detect zero-day attacks and some malwares adopting circumvention techniques such as packer. In order to overcome this drawback, this paper proposes a heuristic detection technique based on expert systems. The technique could detect malwares using known techniques, even bottomlevel techniques, for example, the rootkit technique. It also can detect those malwares even after they are packed or crypto-protected by any packer or protector. And its detection rate is much higher than some well-known anti-virus tools.

关 键 词：启发式技术 专家系统 行为检测 

分 类 号：TP311.52[自动化与计算机技术—计算机软件与理论]