恶意代码反分析与分析综述  

Survey on Malware Anti-analysis and Analysis

作　　者：高玉新[1] 张怡[1] 唐勇[2] 卢泽新[1] 

机构地区：[1]国防科学技术大学计算机学院,长沙410073 [2]国防科学技术大学并行与分布处理重点实验室,长沙410073

出　　处：《小型微型计算机系统》2015年第10期2322-2326,共5页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(61472437)资助

摘　　要：恶意代码反分析与分析技术一直都是计算机安全领域的对抗焦点.恶意代码通过反静态分析和反动态分析两个方面对自身进行保护:反静态分析使用加壳和代码混淆的方法,对反汇编和控制流识别进行干扰;反动态分析检测系统运行环境信息,实现对调试器、虚拟机的反跟踪.与此相对应,分析者和反病毒软件使用脱壳、反混淆及虚拟机技术避免反分析技术的干扰.论文深入分析与总结了各种恶意代码反分析技术的实现原理,及与之相对的分析技术,探讨了这些技术的优缺点与适用性,为恶意代码分析技术的发展提供了一些思路和技术方向.Analysis of malware and anti-analysis technique has always been the focus of the computer security field. Malware implements the self-protection by anti-static analysis and anti-dynamic analysis： anti-static analysis uses the method of packers and code obfuscation to disturb disassembly and identification of control flow;anti-dynamic analysis detects system operating environment information to realize the anti-tracking for debugger and virtual machine. Correspondingly, unpacking, anti-obfuscation and virtual machine technology are used by analysis and anti-virus software to avoid interference by anti-analysis techniques. Paper in-depth analyzes and summarizes the principle of various malware anti-analysis and analysis technology, explores the advantages and disadvantages and applicability of these technologies, provides some ideas and technical direction for the development of malware analysis techniques.

关 键 词：恶意代码 反分析 加壳 代码混淆 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]