基于复制行为的病毒检测  

Detection of Virus Based on Replication Behavior

作　　者：马玉磊[1] 李伟华[1] 车鸣[1] 

机构地区：[1]西北工业大学计算机学院,西安710129

出　　处：《微处理机》2012年第2期80-82,86,共4页Microprocessors

摘　　要：复制是所有病毒都具有的基本特征。给出一个通过检测病毒复制行为来检测病毒的方法。检测病毒复制行为的方法关注病毒复制时执行的读写操作,通过构造这些操作的关系树来检测病毒的复制行为。在实验中对每个病毒和程序调用的Win32 API的日志文件进行分析,检测是否出现了病毒复制行为,结果表明可以通过检测病毒的复制行为来检测病毒。Replication is an essential characteristic of all viruses.The detection of virus is based on an approach to detect the replication behavior of virus.The approach focuses on the operations of read and write executed by virus that is replicating.Detecting replication behavior of virus is accomplished by constructing the relation tree of the operations.The experiment analyses the log files of Win32 APIs called by each virus or normal process to detect whether the replication behavior of virus occurs.The results show that it is valid to detect virus through detecting the replication behavior of virus.

关 键 词：复制 行为 病毒 WIN32 API 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]