基于抽象解释理论抽取多态恶意程序特征码  

Extraction of Polymorphic Malware Signatures using Abstract Interpretation Theory

作　　者：罗文华[1] 

机构地区：[1]中国刑事警察学院,辽宁沈阳110854

出　　处：《信息网络安全》2013年第1期16-18,共3页Netinfo Security

摘　　要：抽象解释理论是Cousot.P和Cousot.R于1977年提出的程序静态分析时构造和逼近程序不动点语义的理论。文章将该理论应用于恶意程序特征码抽取,通过详细描述抽取过程的各个步骤,提出了一种专门针对多态恶意程序的检测方法,从而为恶意程序检测开辟了新的思路。实践证明所述方法准确、高效。interpretation theory was proposed by P. Cousot and R. Cousot in 1977, and it is widely used in the program’s static analysis domain to construct and approximate the program’s fixpoint semantics. This paper puts forward a detection method for polymorphic malware by applying the theory into the extraction of signatures, describes each step in the abstraction process in detail, and opens up a novel thought for malware detection. The method is proved to be accurate and efficient in real work.

关 键 词：抽象解释 多态恶意程序 特征码 变形器 解码器 程序逻辑 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]