Computer malicious software detection novel method based on software control flow features

Abstract

Provided is a computer malicious software detection novel method based on software control flow features. Static analysis is conducted on a control flow structure of a binary file, an operation code sequence is extracted automatically, a spatial vector model is utilized to convert the sequence to structuralized information, the structuralized information acts as a feature set of a file after being screened, a software classification rule is found from volume feature sets by using a data mining method, and the software classification rule is used for detecting malicious software. The computer malicious software detection novel method based on the software control flow features can not only effectively detect common zero-day malicious software, but also have a good detection result for malicious software utilizing a vague and polymorphic technology, and maintain good stability for calculated attack.

Description

technical field [0001] The invention relates to a malware detection method in computer information security, in particular to a malware detection method with good stability in detection results when malware designers use fuzzy and polymorphic techniques to hide code external information and local features . Background technique [0002] With the wide application of computer science in various fields of society, more and more people pay more and more attention to the security of computer software. Establishing a trusted software system has become an effective means to maintain computer information security, and the detection of malicious software has become the core research direction of software credibility analysis. [0003] The traditional signature-based detection method needs to be updated and maintained through a dedicated database to extract relevant signatures in advance, use the scanning engine to find the local information of the software, and use the string matchi...

AI Technical Summary

Problems solved by technology

[0006] First, the signature-based detection method needs to obtain the signature of the malware, and add the ever-increasing signature to the database of the client, and the maintenance of the increasingly large database becomes the price paid by the user

The biggest disadvantage of this detection method is that it is difficult to detect unknown malware, and users cannot deal with new security threats in a timely manner

[0007] Second, using heuristic analysis or software behavior-based detection methods is to classify software by obtaining special local information of the code, but for malware that uses fuzzy and polymorphic software, this local feature is often not fixed, so the detection method Insufficient accuracy in judging these malware

[0008] Third, using standard format information to distinguish software detection methods uses the external description information of the software. Most of this information does not directly involve the behavior of the software. For malware designers who are familiar with this method, they can use the special format information. processing to greatly reduce the detection effect of the method

Images