基于分层权值的恶意程序仿真系统设计与实现  

Design and Implementation of One Malicious Program Simulation System Based on Stratification Weights

作　　者：江雪[1] 朱永强[1] 

机构地区：[1]电子科技大学示范性软件学院,四川成都610054

出　　处：《计算机技术与发展》2014年第4期143-146,150,共5页Computer Technology and Development

基　　金：中央政府专项基金:科技部科技型中小企业创新基金(10C26215122841)

摘　　要：动态启发式中对恶意程序的仿真主要通过沙盒技术来模拟实现。沙盒技术由于其本身仿真能力的局限性,其并不能完全准确地仿真真机环境与指令。针对沙盒的仿真能力的缺陷与不足,结合实际工程应用环境,设计了一套使用专用服务器搭配VMware虚拟机作为仿真环境的恶意程序仿真系统,并根据动态启发式的判断机制,提出了一种基于行为概率分层的权值赋值算法。通过实验,证明了该系统可以有效查杀各类新型与变种恶意程序以及权值赋值算法的有效性。For simulating malicious programs, the sandbox is the regular tool which the dynamic heuristic often uses. Sandbox technology cannot completely and accurately simulate the real PC environments and instruction. Aiming at the limitations of sandbox＇ s simulation ca- pabilities,combined with the actual application environment, design a simulation system based on VMware virtual machine which is used in malicious programs simulating, and propose a weights assignment algorithm based on hierarchical behavior in probabilistic. The experi- ments prove that this system can effectively kill many kinds of new and variants of malicious programs, and the weights assignment algo- rithm is feasible.

关 键 词：动态启发式 恶意程序 VMW^e 行为仿真 概率分层赋值 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]