Malicious file detection method based on composite feature code

Abstract

The invention provides a malicious file detection method based on a composite feature code. The method comprises the steps of: presetting a main feature code set, and setting a corresponding non-feature code for each main feature code; scanning and matching a file to be detected by employing the main feature code set, and judging that the detected file is a malicious file only when any one main feature code in the main feature code set is matched in the file to be detected and any one non-feather code which corresponds to the main feature code can not be matched in the file to be detected. According to the method, the missing report and false report conditions are effectively controlled under the condition that the matching efficiency is guaranteed, the reverse difficulty of feather code positioning software is improved, and the practicality is high.

Description

technical field [0001] The invention relates to the field of computers, in particular to a method for detecting malicious files based on composite feature codes. Background technique [0002] Since the first computer Trojan horse PC-Write in 1986, malicious file detection and anti-detection technologies have been continuously developed in the competition. Traditional malicious file detection mainly uses signature technology, and signature extraction is the core of this detection method. The signature is obtained by performing reverse analysis on known malicious files and extracting code segments with malicious file characteristics. The signature code detection method has high detection efficiency and can accurately detect the type of malicious files and even the specific names of malicious files. [0003] Before 2004, the use of mature signature code antivirus technology can still achieve good antivirus results, but false positives have always been a headache. For example:...

AI Technical Summary

Problems solved by technology

[0004] The present invention provides a method for detecting malicious files based on composite signatures, which is used to solve the problem of low detection accuracy due to false positives in existing signature detection methods. The malicious file detection based on composite signatures provided by the present invention The method can effectively control the false alarm phenomenon when detecting malicious files, the detection accuracy is high, and the detection efficiency is not lower than the existing signature detection method

Images