Malevolence code automatic recognition method

Abstract

The invention belongs to the field of malicious code automatic analysis, and a malicious code automatic identification method. The invention first dismantles an executable program sample under analysis into components under analysis; then, compare a component under analysis with a component affected by known malicious behaviors, in order to automatically determine whether the sample under analysis is a malicious code. The invention has advantages of broad analysis coverage scope, high analysis speed on malicious samples, and updating malicious code behavior component library.

Description

technical field [0001] The invention belongs to the field of automatic analysis of malicious codes, in particular to a method for accelerating the analysis of malicious codes by using reverse engineering technology and code similarity comparison technology. Background technique [0002] On the current Internet, malicious codes are ubiquitous and flooding, seriously threatening network security. Malicious code-related technologies are relatively difficult to implement, but in recent years, with the popularization of the Internet, there have been more and more websites on the Internet dedicated to discussing malicious code implementation technologies. People can directly obtain the source code of malicious code from the Internet. Source code becomes available at your fingertips. These have promoted the proliferation of malicious code variants. In different variants of malicious code, the phenomenon of code segment reuse is very obvious. Many new malicious codes have adopted t...

AI Technical Summary

Problems solved by technology

This approach establishes a correspondence between malicious behaviors and program fragments, but it is difficult to build a robust and discriminative model

Images