Environmental reconstruction based malicious-code integrity analysis method

Abstract

The invention provides an environmental reconstruction based malicious-code integrity analysis method. The method includes: extracting environmental data required during executing process in extracting malicious codes by using reasonable analytical strategies; performing dynamic reconstruction of the execution environment of the malicious codes on the basis of the environmental data; merging the malicious codes into the environment subjected to the dynamic reconstruction for analysis to acquire behavior information which is relatively integral. The problem existing in multipath analysis can be effectively solved, and analysis in integrity of the malicious codes is realized. Compared with a traditional analysis method, the integrity analysis method has the advantages that more reasonable triggering on the key paths can be realized, and accurate behavior characteristics are acquired.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a malicious code integrity analysis method based on environment reconstruction. Background technique [0002] With the rapid development of the Internet, the types and quantities of malicious codes are constantly increasing. The so-called malicious code is a general term for malicious software that realizes the bad intentions of attackers, including viruses, worms, Trojan horses, backdoors, zombies, spyware, adware, etc., and its harm is mainly manifested in stealing user privacy, confidential files, and account information. , destroy data, consume memory and hard disk space, etc. According to a survey report by Symantec in 2014, the number of malicious codes is increasing, and the threat is becoming more and more serious. Its writing, dissemination and utilization present a trend of profit, commercialization and organization. [0003] In the evolution process of malic...

AI Technical Summary

Problems solved by technology

[0013] Aiming at the problems of path explosion, memory leak, low analysis efficiency and program crash caused by forced modification of branch paths in the existing malicious code multi-path analysis methods, the present invention proposes a malicious code integrity analysis method based on environment reconstruction , using the present invention can effectively solve the problems existing in multipath analysis, and realize the integrity analysis of malicious codes

Images