针对客户端的恶意代码分析  

Analysis on malicious code for client

作　　者：王玉玺[1] 周文军[1] 杨剑[1] 

机构地区：[1]江苏第二师范学院数学与信息技术学院,江苏南京210013

出　　处：《河北大学学报（自然科学版）》2015年第2期193-198,203,共7页Journal of Hebei University(Natural Science Edition)

基　　金：国家重点实验室基地开放课题(9011311);江苏第二师范学院"十二五"规划课题(JSNU-Y-4632)

摘　　要：恶意代码数量多且变种多样,通常会通过加密隐藏真实目的,沙盒可以为恶意代码提供一个安全的运行环境,在实验时借助沙盒分析和揭露恶意代码的行为特征,发现很多恶意代码看似不同,实际为同一恶意代码的变种.最后对若干恶意代码样本进行分析,通过特征码对样本中的恶意代码进行分类,验证了恶意代码变种的现象.The malicious codes can be divided into two types of boot and destructive, and they attack various vulnerabilities for client systems. The quantity of these codes is growing faster, and so much variants have been or will be produced for these codes. Some codes are encrypted to hide their true purpose. Because of the concealment for malicious codes, it is difficult to directly determine the authenticity of malicious codes. Sandbox can provide a secure environment for malicious codes to expose their behavior and find the characteristics. By this way malicious codes can be killed better. It can reveal the hidden malicious code and also verify the feasibility of these detection methods through a number of virus samples tested.

关 键 词：恶意代码 沙盒 特征码 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]