Malicious Code Integrity Analysis Method Based on Environment Reconstruction

Abstract

The invention provides an environmental reconstruction based malicious-code integrity analysis method. The method includes: extracting environmental data required during executing process in extracting malicious codes by using reasonable analytical strategies; performing dynamic reconstruction of the execution environment of the malicious codes on the basis of the environmental data; merging the malicious codes into the environment subjected to the dynamic reconstruction for analysis to acquire behavior information which is relatively integral. The problem existing in multipath analysis can be effectively solved, and analysis in integrity of the malicious codes is realized. Compared with a traditional analysis method, the integrity analysis method has the advantages that more reasonable triggering on the key paths can be realized, and accurate behavior characteristics are acquired.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a malicious code integrity analysis method based on environment reconstruction. Background technique [0002] With the rapid development of the Internet, the types and quantities of malicious codes are increasing. Generally speaking, malicious code is a general term for malicious software that realizes the bad intentions of attackers, including viruses, worms, Trojans, backdoors, zombies, spyware, adware, etc. Its harm is mainly manifested in stealing user privacy, confidential files, account information , destroy data, consume memory and hard disk space, etc. According to the 2014 Symantec (Symantec) investigation report, the amount of malicious code is increasing, and the threat is becoming more and more serious. [0003] During the evolution of malicious code attack technology, in order to achieve precise control and complete specific operations, different behavior ...

AI Technical Summary

Problems solved by technology

[0013] Aiming at the problems of path explosion, memory leak, low analysis efficiency and program crash caused by forced modification of branch paths in the existing malicious code multi-path analysis methods, the present invention proposes a malicious code integrity analysis method based on environment reconstruction , using the present invention can effectively solve the problems existing in multipath analysis, and realize the integrity analysis of malicious codes

Images