一种利用动态控制流路径分析的隐藏恶意代码异常检测方法  

A method for hidden malcode anomaly detection using dynamic control-flow analysis

作　　者：潘剑锋[1] 刘守群[1] 奚宏生[1] 谭小彬[1] 

机构地区：[1]中国科学技术大学自动化系,合肥230027

出　　处：《中国科学院研究生院学报》2010年第1期138-143,共6页Journal of the Graduate School of the Chinese Academy of Sciences

基　　金：国家"863"计划基金项目(2006AA01Z449)资助

摘　　要：提出了一种基于动态控制流路径分析的隐藏恶意代码检测方法.该方法首先有针对性地选取与恶意代码相关的敏感路径并动态记录其执行过程的控制流路径,然后采用基于调用层次树匹配的异常检测算法分析所获得的数据,从而检查出系统中隐藏型恶意代码.实验结果表明,该方法能有效检测出隐藏恶意代码,具有高检出率和低误报率的特点,适用于计算机操作系统内的隐藏型恶意代码的检测.The present study proposes a method for hidden malcode detection based on the analysis of dynamic control-flow. First we recorded the malcode-related control-flow paths of program,and then the control-flow paths were analyzed,by calling tree match algorithm,to detect the hidden malcode in the system. The experiments show that this method can detect hidden malcode efficiently at a high detection rate and with low false positive,and thus it can be applied to malcode detection on operating systems.

关 键 词：恶意代码 异常检测 动态控制流 调用树编辑距离 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]