Malicious program detection method based on function characteristics

Abstract

The invention provides a malicious program detection method based on function characteristics. The malicious program detection method includes the steps of (1) selection of performance functions of malicious programs, namely selecting malicious program samples, carrying out disassembling and manual analysis and specifying functions closely related to malicious behaviors as the performance functions, (2) extraction of function characteristics, namely processing function body codes of the functions closely related to malicious behaviors, removing interference instructions, identifying conditional judgment statements and loop statements, and converting all the statements into equivalent expression forms as the function characteristics, (3) establishment of malicious program characteristic library, namely establishing a malicious program characteristic library as a malicious program model by using the function characteristics of the performance functions of all the malicious program samples and by using of a malicious program sample library; and (4) detection of malicious programs, namely analyzing a function characteristic set of all functions of a program to be detected by using the malicious program characteristic library, and determining whether the function characteristic set is consistent with a characteristic model in the malicious program characteristic library or not to identify whether the program to be detected is the malicious program or not.

Description

technical field [0001] The invention relates to identification and detection of malicious programs, in particular to a method for detecting malicious programs based on function semantic features. Background technique [0002] At present, most malicious program detection adopts behavior-based detection methods, which use API-related data flow and control flow relationships to identify malicious behaviors. However, Windows' DLL loading mechanism allows dynamic libraries to be easily replaced. Insufficient integrity verification of DLL files and the emergence of Hooking technology make it extremely easy to tamper with DLLs. Moreover, when a malicious program runs in the operating system kernel, it can tamper with the content of the function at will, even the implementation of the system call. Even without changing the calling rules, the code actually executed by the program has changed. Therefore, the API-based detection mechanism is no longer effective, resulting in false d...

AI Technical Summary

Problems solved by technology

Therefore, the API-based detection mechanism is no longer effective, resulting in false detection results and false positives

Images