污点标记技术在恶意代码分析中的应用  

Application of stain labeling technique in malicious code analysis

作　　者：杨思燕[1] 归达伟[1] 杨元柱[1] 

机构地区：[1]陕西广播电视大学计算机与信息管理系,陕西西安710119

出　　处：《现代电子技术》2015年第13期76-80,共5页Modern Electronics Technique

基　　金：陕西工商职业学院课题(13G-08-B22);陕西省教育科学"十二五"规划课题(SGH140851)

摘　　要：利用虚拟机技术对恶意代码进行动态分析的方法成为目前安全领域研究的重点,国内外相关的研究大部分集中于理论方面,而相关的应用较少。提出以基于全系统模拟器QEMU作为监控平台,通过编写远程控制模块,对目标程序进行动态的实时分析,提取出目标程序的API调用序列以及对应的参数信息,并利用污点标记技术对产生的数据进行关联,有效地提取出目标代码的行为特征,给判断未知程序是否为恶意代码提供了依据。实验表明,相比同类工具,自动分析平台具有更好的分析结果。The method to dynamically analyze the malicious code with virtual machine technology has become a research emphasis in security domain. Generally speaking, most of relevant researches at home and abroad focused on theory, while less on application. In this paper, a new method is proposed, which takes full-system emulator QEMU as monitoring platform to pro- ceed dynamic real-time analysis on the target program by programming remote control program, and to extract the API calling se- quence and its corresponding parameter information of the target program. The stain labeling technique is used to relate the gen- erated data to extract behavior features of the target program effectively. It provides a theoretical basis for judging whether un- known programs are malicious codes. Experimental results indicate that the realized automatic analysis platform can achieve bet- ter analysis result than other similar tools.

关 键 词：恶意代码 行为监控 QEMU 动态污点标记 

分 类 号：TN915.08[电子电信—通信与信息系统]