Malicious code detecting method and system based on character string weight adjusting

Abstract

The invention provides a malicious code detecting method and system based on character string weight adjusting. The method includes: building a character string library, and setting character string weight; using the character string library to perform matching detection on suspicious programs, and adding other character strings in the suspicious programs into the character string library if the suspicious programs are malicious; matching the character strings in the character string library with a blacklist and a white list according to preset time intervals, subtracting one form the corresponding character string weight if the character strings are matched with the white list, and adding one to the character string weight if the character strings are matched with the blacklist. By the method and system, self-learning of the character string library is achieved, character string weight is adjusted automatically at any time according to blacklist and white list matching, suspicious program detecting precision is increased, and false alarm rate is lowered.

Description

Technical field [0001] The present invention relates to malicious code detection technology, in particular to a malicious code detection method based on string adjustment weights. Background technique [0002] With the outbreak of network security incidents such as "Stuxnet worm", "dequ", and "Red October" in recent years, advanced sustainable attacks have attracted worldwide attention. Traditional malicious code detection and identification methods usually use static signature scanning to identify viruses. This method is characterized by mature computer virus technology and widespread spread of malicious code fragments, strong configurability and high replication rate of malicious code, which makes traditional The detection rate of malicious code recognition technology is relatively high. However, since most advanced sustainable attacks are well-organized and written and do not take the malicious code fragment features commonly circulated on the Internet, it is difficult to ide...

AI Technical Summary

Problems solved by technology

[0003] The present invention provides a malicious code detection method and system based on character strings to adjust weights. Through the method of the present invention, the problem that the character strings in the static signature detection mode are fixed and cannot cope with advanced sustainable attacks is solved, so that the character strings can Adjust at any time according to the black and white lists to form a high-accuracy string library

Images