基于中间代码的恶意软件检测技术研究  

Malware detection technologies based on software intermediate code

作　　者：杨洪深[1] 赵宗渠[2,3] 王俊峰[2] 

机构地区：[1]铜陵学院电气工程系,铜陵244001 [2]四川大学计算机学院,成都610065 [3]河南理工大学计算机学院,焦作454000

出　　处：《四川大学学报（自然科学版）》2013年第6期1216-1222,共7页Journal of Sichuan University(Natural Science Edition)

基　　金：安徽省教育厅自然科学研究项目(KJ2012Z412);国家自然科学基金项目(11102124;61102076;60939002);教育部新世纪优秀人才计划项目(NCET-10-0604);四川省科技支撑计划项目(2013SZ0002)

摘　　要：软件的中间代码是位于机器语言和高级程序语言之间程序语言,具有容易理解的语义信息和控制结构信息,能真实地反映软件在执行过程中的实际情况.利用中间代码的语义信息来研究恶意软件,可以发现恶意软件的具体行为信息或特点;通过多种方式对比中间代码形成的控制流图整体或局部信息,实现恶意软件的检测.机器学习为软件安全性信息或规则挖掘提供便利,成为一种先进的恶意软件检测方法.本文从中间代码的语义信息和控制结构两方面对多种恶意软件检测技术进行归类与比较,同时对基于机器学习的中间代码处理与应用方法进行了深入分析和探讨.The intermediate code is a special style machine language and the high level programming of software representation which locates between the language, and it can take advantage of understandable semantic information and actual execution condition for mation and characteristics can be easily found from the malware analysis. The malicious behavior infor- semantic information of intermediate code, and malware detection or classification can be realized by analyzing the whole or local information of control flow graph. Machine learning facilitates security information and rules mining in a large number of com- plex software representations,which is deemed as a kind of advanced malware detection method in recent malware research. This paper categorizes and analyzes the malware research technologies according to the semantic information and control flow structure of software intermediate code, and makes deep anal- ysis to intermediate code processing and application methods based on machine learning.

关 键 词：恶意软件检测 中间代码 软件特征 机器学习 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]