非包还原恶意代码检测的特征提取方法  

A Non-packets-reducing Based Malware Signature Extraction Method

作　　者：王光卫[1] 陈健[1] 范明钰[1] 

机构地区：[1]电子科技大学计算机学院,四川成都611731

出　　处：《信息安全与技术》2013年第12期25-28,共4页

基　　金：国家863项目资助(编号:2009AA01Z435;2009AA01Z403)

摘　　要：恶意代码在网络中传播时不会表现出恶意行为,难以通过基于行为的检测方法检测出。采用基于特征的方法可以将其检测出,但需要进行网络包还原,这在大流量时对网络数据包进行还原不仅存在时空开销问题,且传统的特征提取方法提取的特征往往过长,容易被分割到多个网络数据包中,导致检测失效。本文提出非包还原恶意代码特征提取,采用自动化与人工分析相结合、基于片段的特征码提取,以及基于覆盖范围的特征码筛选等方法,实验结果表明,对恶意软件片段具有一定识别能力。The popularity of the network has brought great convenience for the dissemination of malicious code. Because malicious code in the network communication does not show any malicious behavior, it is difficult to detect their spreading using behavior-based detection methods. Signature detection methods can be used to detect malicious code spreading, but, not only data packets reducing requires time and space cost tradeoffs in the large flow network, but also, the malicious code signatures extracted from traditional metfiods are often too long, and the signatures are easily split into multiple network packets, resulting in failure detection. Malicious code detection method based on non - packet reducing （NPR Based Malware Signature Extraction Method）proposed in this paper, to a certain extent solved the above problems. Experiment results show that the proposed NPR method has good results in detecting small fragments of malicious code.

关 键 词：特征码提取 非包还原方法 恶意代码检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]