多态shellcode动态检测与特征提取  

Dynamic detection and signature generation for polymorphic shellcode

作　　者：张钢岭[1] 何聚厚[1] 

机构地区：[1]陕西师范大学计算机科学学院,陕西西安710062

出　　处：《郑州轻工业学院学报（自然科学版）》2010年第4期67-70,共4页Journal of Zhengzhou University of Light Industry:Natural Science

基　　金：国家自然科学基金项目(60503008)

摘　　要：提出了多态shellcode动态检测和特征提取模型:基于模拟执行和动态检测技术,可以有效发现多态shellcode变种和未知攻击方式并生成特征码;基于模拟执行网络代码并以GetPC code和循环解密操作作为行为特征检测网络数据流,对相似可疑数据流进行聚类并提取字节序列特征.实验结果验证了该模型的可行性和有效性.Dynamic detection and signature generation for polymorphic shellcode model are proposed.Based on emulation and dynamic detection technology,variants of polymorphic shellcode and unknown attack can be effectively discovered and then the signature is generated.Emulation-based implementation of the network code and GetPC code and recycling decryption operations is made as acts of feature detect network data stream,clustering the data stream for similar suspicious and extracting the byte sequence signature.The experimental results verify the feasibility and effectiveness of the model.

关 键 词：多态shellcode 模拟执行 入侵检测 特征提取 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]