API use action discovering and malice deciding method after confusion of multi-tier synergism

Abstract

The invention relates to a stratification synergic detection and judgment method for detecting the confused API call behavior and judging the maliciousness of the call behavior; the detection and judgment method includes three steps: firstly, the binary code for being analyzed is disassembled to establish the control flow graph (CFG) of the program; the known unconventional instruction or data sequence provided with the API function call capability and stored in the database DB1 is adopted to recognize the unconventional call behavior of the API function; secondly, the generation operation of the API sequence called by the target program is finished; the API function is recognized and recovered in the aspects of direct call and indirect call; finally, the extraction of the API sequence and the maliciousness judgment operation are finished; the extraction of the sequence is finished and based on the control flow graph (CFG) of the program; then the obtained sequence is normalized according to the format stored in the suspected API sequence database; the invention provides a stratification synergic detection and judgment method for detecting the confused API call behavior and judging the maliciousness of the call behavior, which has the advantages of wide recognition range, accurate recognition and high efficiency.

Description

(1) Technical field: [0001] The invention relates to a static analysis method for discovering API function calling behavior of obfuscated target executable code and judging its maliciousness, in particular to a method for discovering API calling behavior after obfuscation and judging its maliciousness through layered coordination. (two), background technology: [0002] Any program must achieve its purpose through behavior. No matter how ingeniously disguised a malicious program is, it always has some different and relatively special behaviors from benign programs, which we call suspicious behaviors. Whether it is executable malicious code in binary format, script virus or macro virus, they are all programs that need to call various functions provided by the operating system to achieve the purpose of propagating themselves and destroying the system. It is often not used in benign programs. Therefore, the call to suspicious functions can be regarded as one of the suspicious b...

AI Technical Summary

Problems solved by technology

However, more and more malicious code writers use this technology to evade the detection of malicious code detection tools based on signature matching, which brings great difficulties to the analysis work of malicious code analysts

Among them, many code obfuscation methods used to confuse the behavior of API calls also make it difficult to realize the method of judging the maliciousness of the code by discovering the calling behavior of API functions.

Images