基于自相似特性的恶意代码动态分析技术  

Malicious Code Dynamic Analysis Based on Self Similar Characteristics

作　　者：李鹏[1,2] 王汝传[1,2] 

机构地区：[1]南京邮电大学计算机学院,江苏南京210046 [2]南京邮电大学江苏省无线传感网高技术研究重点实验室,江苏南京210003

出　　处：《南京邮电大学学报（自然科学版）》2012年第3期86-90,共5页Journal of Nanjing University of Posts and Telecommunications：Natural Science Edition

基　　金：国家自然科学基金(60973139;60773041);江苏省科技支撑计划(工业)项目(BE2010197;BE2010198);江苏省级现代服务业发展专项资金;高校科研成果产业化推进工程项目(JH10-14);江苏高校科技创新计划项目(CX10B-196Z);江苏省六大高峰人才项目(2008118);教育部高等学校博士学科点专项科研基金(20103223120007);南京邮电大学青蓝计划(NY208010)资助项目

摘　　要：在比较恶意代码的分析技术的基础上,将自相似特性技术引入恶意代码的动态分析中。跟踪同类型的恶意程序,采集API函数的调用序列,提取关键特征信息,得到时间调用序列,并进行归一化处理。通过重新标度权差分析算法、回归方差算法和Higuchi算法,分别计算程序的Hurst指数,匹配同种恶意程序的自相似性。将恶意程序与正常程序的API调用序列和Hurst指数进行对比实验表明,恶意程序调用API函数与正常程序存在差异,并且同一类型的恶意程序确实具有自相似性,从而能够动态检测出恶意程序。Based on the comparison between the two kinds of analytical technologies of malicious codes, the paper introduces self similar characteristics into the dynamic analysis of malicious code process. It follows the tracks of the same type of malicious programs, capture the API calls information, pick up key fea- tures from time sequence, and then normalize it. The Hurst index by the series use of R/S method, aggre- gated variance method and higuchi method was computed respectively, and the similarity of the same type malicious programs was matched. Comparing the API functions and Hurst index that malicious programs and normal procedures call, it comes to the conclusion that malicious programs have some differences in calling API function with normal procedure, and the same type of malicious programs are self-similar, so that it identifies malicious programs with dynamism.

关 键 词：恶意代码 自相似性 API序列 HURST指数 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]