基于交互行为的恶意代码检测研究  

Study of malware detection based on interactive behavior

作　　者：孙晓妍[1] 祝跃飞[1] 黄茜[1] 郭宁[2] 

机构地区：[1]信息工程大学信息工程学院,郑州450002 [2]兰州大学信息科学与工程学院,兰州730000

出　　处：《计算机应用》2010年第6期1489-1492,共4页journal of Computer Applications

基　　金：国家863计划项目(2008AA01Z420)

摘　　要：恶意代码的智能化检测对恶意代码的分析有着重要的意义。在针对恶意代码动态交互序列的自动分类问题上,基于滑动窗口的序列特征进行的自动分类面临着序列混淆、噪声注入和模拟序列等问题。针对上述3个问题,分别使用分支序列、马尔可夫链的状态转移概率矩阵和交互对象来进一步地完善基于交互序列的恶意代码自动分类,并给出了分类总体流程的设计。实验结果表明能够有效解决上述问题。The intelligent detection of malware has significant importance in the field of malware analysis.This paper studied the automatic classification issues of malware sequence of dynamic traces.The automatic classification method based on sliding windows of sequence characteristics could not resist the sequence confusion,noise injection and mimic sequence to evade detection.This paper studied the three above-mentioned problems.It used the branching sequences,Markov chain state transition probability matrix and interactive objects respectively to improve the automatic classification of malware based on interactive sequence,and gave the design of the overall classification process.Finally,the experimental results prove the above-mentioned problems can be resolved effectively.

关 键 词：恶意代码 交互行为 序列混淆 噪声注入 模拟序列 

分 类 号：TP302.1[自动化与计算机技术—计算机系统结构]