Software identification method and device

Abstract

The embodiment of the invention discloses a software identification method and device. The software identification method includes: disassembling the executable file of the software to be identified; determining the type of compiler used by the disassembled executable file; extracting the disassembled executable file according to the type of the compiled program. The user-defined function in the file; generate the feature value to be identified corresponding to the user-defined function; determine the matching number of the feature value to be identified and the feature value stored in the feature library, wherein the feature library stores the user-defined extracted from the malware The feature value corresponding to the function, and the feature value stored in the feature library has the same data length as the feature value to be identified; according to the ratio of the number of matches to the total number of feature values ​​to be identified, determine the software to be identified Attributes. Compared with the prior art, the method of extracting feature values ​​in this solution makes the features stronger, thereby improving the accuracy of the recognition software.

Description

technical field [0001] The invention relates to the field of software identification, in particular to a software identification method and device. Background technique [0002] With the rapid development of science and technology, numerous electronic devices have a greater impact on people's work and life. At the same time, the increasingly large scale of software and the cumbersome division of labor make it difficult to guarantee the quality of software products, thus bringing about increasingly serious hidden dangers of software security. Therefore, software identification methods for identifying normal software and malicious software have been attracting much attention. [0003] The existing software identification method is to divide the disassembled executable file into several code segments, extract the characteristic values ​​from the code segments, and match them with the characteristic values ​​in the characteristic library constructed in advance based on malware,...

AI Technical Summary

Problems solved by technology

[0004] However, in the existing software identification methods, the feature generics are low, resulting in poor versatility

At the same time, malicious software creators can change the code segment by packing, adding flower, random order, or modifying the entry of the executable file to fight against existing software identification methods; even, malware creators only need to modify the original code Basically, add some new functions at will, and the original features will disappear, which will eventually make the malware unrecognizable

[0005] In summary, the existing software identification methods are not very accurate for software identification.

Images