Malicious code detection method

Abstract

The invention discloses a malicious code examination method based on the semanteme, which may completely portray aggressive behaviors based on the function call, effectively distinguishes malicious behaviors in the binary suspicious procedure, and belongs to the Internet safety technology domain. The method of the invention includes: a) to obtain the finite state automata of the known malicious code; b) to obtain the push down automata of the binary suspicious procedure to be examined; c) to use a model inspection method to inspect whether an input character string which can be simultaneously received exists between the push down automata and the finite state automata or not, if yes, the suspicious procedure to be examined is judged as the malicious procedure. The invention uses the finite state automata to describe the malicious behaviors, combines the existing tool and the method to convert the suspicious program to be the push down automata, then uses the existing model inspection method to examine whether the malicious code is contained in the suspicious procedure or not. And the malicious code examination in the Internet safety technology domain can be effectively used.

Description

technical field [0001] The invention relates to a malicious code detection method based on semantics, which can completely characterize the attack behavior based on function calling, and effectively identify the malicious behavior in binary suspicious programs. It belongs to the field of Internet security technology. Background technique [0002] With the rapid development of network and computer technology, the types of malicious code, the speed of transmission, the number of infections and the scope of influence are gradually increasing. Malicious code has become an important factor threatening Internet security and computer system security, and the analysis and detection of malicious code is an important link in all security strategies. [0003] The traditional most widely used malicious code detection technology is the detection technology based on signature. It extracts a certain binary fragment in the malicious code as the "fingerprint" of the malicious code. When th...

AI Technical Summary

Problems solved by technology

[0004] However, this method cannot identify malicious codes with unknown characteristics, and the release of new virus signatures or "fingerprints" always lags behind the spread of viruses

Moreover, because different grammatical expressions may have the same semantics, traditional fingerprint matching detection methods are easily bypassed, and traditional detection methods cannot identify polymorphism or deformation of the same malicious code.

Images