基于对象语义的恶意代码检测方法  

Object-semantics based malware detection method

作　　者：任李 潘晓中[1,2,3] 

机构地区：[1]武警工程大学电子技术系网络与信息安全研究所,西安710086 [2]武警工程大学电子技术系网络与信息安全武警部队重点实验室,西安710086 [3]海军计算技术研究所,北京100841

出　　处：《计算机应用研究》2013年第10期3106-3109,3113,共5页Application Research of Computers

基　　金：国家自然科学基金资助项目(61272492;61103231;61103230)

摘　　要：恶意代码变种给信息系统安全造成了巨大威胁,为有效检测变种恶意代码,通过动态监控、解析系统调用及参数,将不同对象操作关联到同一对象,构建对象状态变迁图,然后对状态变迁图进行抗混淆处理,获取具有一定抗干扰性的恶意代码行为特征图。最后,基于该特征图检测未知代码。实验结果表明,该方法能够有效抵抗恶意代码重排、垃圾系统调用等混淆技术干扰,而且误报率低,在检测变种恶意代码时具有较好的效果。Malware variants make a big threat to security of information system. To detect variants of malicious codes effec- tively, through dynamic monitoring and parsing system calls and parameters, this paper related different object operations to the same object, and constructed the object state changing graph. Then it processed the object state changing graph by an anti-ob- fuscation method to acquire the anti-interference behavior signatures graph of malware. Finally, it detected unknown codes based on the behavior signatures graph. As the results of the experiments show, the method can effectively resist the inference like the rearrangement of malicious codes and the inserting of useless system call. It has a low false negative rate in detecting normal programs and has a good result in detecting variants of malicious codes.

关 键 词：恶意代码检测 系统对象 抗混淆 语义 状态变迁图 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]