APT detection method and system based on compiler recognition

Abstract

The invention discloses an APT detection method and system based on compiler recognition. The method includes the steps that firstly, a PE file to be detected is obtained, whether the PE file has a compiler feature code at a specific position or not is detected, if the PE file has the compiler feature code at the specific position, it can be determined that the PE file is a non-virus program, otherwise whether the PE file has compiler feature codes at other positions except for the specific position or not is detected, if the PE file has the compiler feature codes at other positions except for the specific position, it can be determined that the PE file is a virus program, otherwise it can be determined that the PE file is a shell application, unshelling processing is performed on the PE file, and detection is continued. According to the method, known viruses and unknown viruses can be effectively detected without depending on a huge virus library.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to an APT detection method and system based on compiler identification. Background technique [0002] Traditional virus detection methods are usually based on signature detection, that is, according to the captured samples, a common code is extracted for the same virus or the same virus family as a signature, so as to avoid false positives for normal files and realize virus detection. the goal of. [0003] Because the traditional virus detection method is based on the signature code, it is more effective for the detection of known viruses, but it is powerless for unknown viruses. Moreover, the traditional virus detection method needs to carry a huge virus database, and the detection ability depends to a large extent on whether the update of the virus database is timely. The emergence of new viruses, such as mutant viruses or polymorphic viruses, poses challenges ...

AI Technical Summary

Problems solved by technology

[0003] Because the traditional virus detection method is based on the signature code, it is more effective for the detection of known viruses, but it is powerless for unknown viruses.

Moreover, the traditional virus detection method needs to carry a huge virus database, and the detection ability depends to a large extent on whether the update of the virus database is timely.

The emergence of new viruses, such as mutant viruses or polymorphic viruses, poses challenges to traditional virus detection, because traditional methods cannot extract public features

Images