基于运行时行为序列分析的恶意行为检测系统  

Runtime behavior sequence analysis based malicious behavior detection system

作　　者：姜冲[1] 李宁[1] 刘渊[2] 董碧丹[1] 

机构地区：[1]中国航天系统科学与工程研究院,北京100048 [2]中国工程物理研究院计算机应用研究所,四川绵阳621900

出　　处：《计算机工程与设计》2016年第3期602-608,共7页Computer Engineering and Design

基　　金：中国工程物理研究院网络与信息安全重点实验室开放基金项目(J-2014-KF-01)

摘　　要：为保证互联网应用的安全,减少因安全漏洞造成的经济损失,通过对恶意代码的逆向化研究,提出针对运行时恶意行为的检测系统。针对关键行为的分析,提取并建立相关函数API调用序列的恶意行为库,提出粗、细双层匹配推理机设计,通过常驻内存的模式化跟踪方法,实现对库函数运行状态的实时监控。实验结果表明,该系统能够有效防止软件恶意行为对于主机系统的破坏。To ensure the safety of Internet applications and reduce economic losses caused by breach of security,through the reverse study of malicious code,a detection system for running malicious behavior was proposed.the key behavior was analyzed,malicious behavior base of related API function call sequence was extracted and established,and the coarse,fine double matching design of reasoning machine was put forward.Using the tracking method based on the mode of memory resident,the running state of the library functions was monitored in real time.Experimental results show that,the proposed system can effectively prevent the host system from malicious software behavior.

关 键 词：恶意代码 行为库 常驻内存 推理机 检测系统 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]