论文部分内容阅读
随着网络及应用技术的不断发展,恶意代码的问题日益突出。目前大多数反病毒措施都是基于传统的基于特征码的扫描技术,使用“扫描引擎+病毒库”的结构方式虽然对已知病毒的检测相对准确,但对新出现的恶意代码无法准确、及时地做出检测。本文提出了一种基于亲缘性恶意代码分析方法,使用系统函数集合、行为特征、相似代码特征这三个方面来表征一类恶意代码的特征,以达到缩小特征库规模,快速检测未知恶意代码的目的,特别是变种恶意代码。实验结果表明本文所提出的方法可以取得良好的检测结果。
With the continuous development of network and application technology, the problem of malicious code has become increasingly prominent. At present, most anti-virus measures are based on the traditional signature-based scanning technology. The use of the “scan engine + virus database” structure is relatively accurate for the detection of known viruses, but it is not accurate for emerging malicious code , In a timely manner to make testing. In this paper, a method based on affinity malicious code analysis is proposed to characterize a class of malicious code by using system function sets, behavior features and similar code features in order to reduce the size of feature database and quickly detect unknown malicious code Purpose, especially variants of malicious code. The experimental results show that the proposed method can achieve good results.