A Malicious Code Analysis and Detection Method Based on Dynamic Semantic Features

Abstract

The invention relates to a malicious code analysis and detection method based on dynamic semantic features. The method comprises the steps that (1) codes to be analyzed and detected in a malicious sample library are dynamically operated in a virtual environment, the operation process of the codes to be analyzed and detected in the malicious sample library is monitored, and the primitive characters of the codes to be analyzed and detected in the malicious sample library are extracted; (2) API name information standing for the semantic features of the codes is screened out; (3) an API sequence semantic feature set standing for the semantic features of the codes is established; (4) a semantic feature library with representative semantic features is selected; (5) similarity detection is carried out between the semantic feature set of the codes to be detected and the semantic feature library to obtain a detection result, namely, whether the codes to be detected are benign codes or malicious codes is detected. According to the malicious code analysis and detection method based on the dynamic semantic features, different semantic features can be established according to different samples, good universality is achieved, a method for selecting representative features is proposed, the semantic features of the codes can be expressed accurately, the analysis and detection on the malicious codes are more accurate, and detection cost is low.

Description

technical field [0001] The invention belongs to the technical field of system security, relates to a malicious code analysis and detection method, in particular to a malicious code analysis and detection method based on code dynamic feature extraction and modeling. Background technique [0002] With the rapid development of computer technology, the Internet has brought a lot of convenience to people's life and work and has gradually become an indispensable part of people's daily life. Nowadays, people conduct various social activities and commodity transactions on the Internet, and there are many users' private information and potential economic benefits on the Internet, which attract many malicious attackers, who use various technical means to achieve their goals, among which One of the more common ways is through the use of malware. [0003] Any software involving eight phenomena including forced installation, difficult uninstallation, browser hijacking, pop-up advertisem...

AI Technical Summary

Problems solved by technology

Static analysis uses methods such as disassembly to analyze code features. From the perspective of grammatical features, some malicious codes can indeed be detected, but the grammar cannot fundamentally reflect the "maliciousness" of malicious codes. The semantics expressed by different grammars can be the same. of

Images