Multilayer semantic annotation and detection method against malignancy

Abstract

The invention relates to a method of adopting the multi-layer semantic annotation technology to analyze the intermediate result and detect the annotation information in layering mode based on the analyzed intermediate result during the malicious behavior detection. The model includes an annotation sub-module and a detection sub-module; wherein, the annotation sub-module includes a binary semantic layer, a linear instruction semantic layer, a control flow chart semantic layer, a process call chart semantic layer and an application level semantic layer. The annotation is processed towards the specified analysis target object in each layer. The detection sub-module detects the malicious behavior on the annotation information in layers based on the corresponding analysis strategy and the algorithm. The invention has the advantages of effectively decomposing the complexity of the malicious behavior detection, utilizing the advantages of different detection mechanisms, avoiding the inherent defects of different mechanisms, improving the adaptability and accuracy of the malicious behavior detection.

Description

1. Technical field: [0001] The invention relates to a multi-layer labeling and detection method for computer malicious behavior codes, belongs to the technical field of computer security, and is particularly suitable for the analysis and identification technology of malicious behavior codes in binary executable codes. 2. Background technology: [0002] Computer viruses have plagued computer experts and users alike for a long time. The ability of replication, transmission and destruction of computer virus makes it a serious threat to the normal use of computers. In recent years, the rapid development of the network has made the spread of computer viruses more convenient, and the number of computer virus programs has grown explosively, posing a serious threat to computer systems and information security. The emergence of simple computer virus generation tools makes the writing of computer viruses a common phenomenon, which makes the situation of computer virus defense increas...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the detection of malicious behavior in binary codes, the present invention proposes a multi-layer software malicious behavior marking method based on program semantic analysis, and a malicious behavior monitoring system based on this marking method, which is mainly used to solve the analysis of unknown computer viruses Efficiency issues and detection of computer malicious behavior at a higher level

Images