Method and device for automatically processing malicious code sample

Abstract

The invention discloses a method and device for automatically processing a malicious code sample. The method includes the steps of obtaining the malicious code sample, extracting static characteristics from the obtained malicious code sample, matching the static characteristics of the malicious code sample with known static characteristics in a static characteristic library, continuing to extract dynamic behavior characteristics from the malicious code sample if it cannot be judged that the obtained malicious code sample is a malicious code according to the static characteristic library, matching the dynamic behavior characteristics of the malicious code sample with known dynamic behavior characteristics in a dynamic behavior characteristic library, and conducting false alarm feedback if it can be judged that the obtained malicious code sample is not a malicious code according to the dynamic behavior characteristic library so as to prompt that the malicious code sample is a non-malicious code. The malicious code sample can be accurately recognized, and the false alarm rate of the malicious code is lowered.

Description

technical field [0001] The invention belongs to the technical field of computers, and in particular relates to a method and a device for automatically processing malicious code samples. Background technique [0002] Malicious code is also known as Malware. Malicious code is "a set of instructions that run on a computer to make the system perform tasks according to the attacker's wishes." Malicious code embeds instructions into other codes under the condition of concealing itself, so as to destroy the integrity of data information on the infected computer and run intrusive programs. The types of malicious code include computer virus (Virus), worm (Worm), Trojan horse (Trojan horse), botnet (Botnet), spy network (spyware), backdoor (Backdoor), Rootkitsd, etc. [0003] At present, computer malicious codes are spreading at an alarming speed, posing a serious threat to the security of computer systems. Early anti-virus software used the static feature of malicious code signatu...

AI Technical Summary

Problems solved by technology

It is even more helpless for

Images