基于序列比对的勒索病毒同源性分析  

Homology Analysis of Ransomware Based on Sequence Alignment

作　　者：龚琪 曹金璇[1] 芦天亮[1] 

机构地区：[1]中国人民公安大学信息技术和网络安全学院,北京100076

出　　处：《计算机与现代化》2018年第2期1-5,共5页Computer and Modernization

基　　金：国家重点研发计划"网络空间安全"重点专项(2017YFB0802804);国家自然科学基金资助项目(61602489);赛尔网络下一代互联网技术创新项目(NGII20160405)

摘　　要：勒索病毒近年来数量呈爆发式增长,但其中真正的新型家族并不多,多数为已有家族变种。通过研究恶意代码行为特征,提出一种基于序列比对的同源性分析方法。使用沙箱提取勒索病毒动态行为特征,抽取API调用类别,并进行编码、去重,结合序列比对算法计算不同恶意代码之间的相似性,从而分析同源性。数据集选取6类勒索家族及其变种。实验结果表明该方法能较好地分析勒索病毒同源性,并能很好地区分正常软件和勒索病毒。The number of ransomware is increasing rapidly while few belong to new family,most of them are mutations. A new homologous analysis approach based on API sequence of ransomware is proposed. The paper uses sandbox to extract ransomware＇s dynamic behavior for analyzing API category,and then encodes the feature as well as removes the repetition. Also,the sequence alignment algorithm is used to calculate the similarity between different ransomware. The dataset for the experiment contains 6 different families of ransomware and their variants. The result shows that proposed method performs well in analyzing the homology of ransomware which can be used to distinguish unknown software.

关 键 词：勒索软件 动态检测 沙箱 API序列 序列比对 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]