Behavior characteristic similarity-based malicious code homology analysis method

Abstract

The invention provides a behavior characteristic similarity-based malicious code homology analysis method, which comprises the steps of: firstly extracting and quantifying behavior characteristics representing malicious codes based on a dynamic binary pile platform, on this base, measuring the similarity of the behavior characteristics among different malicious codes, and reflecting a homology judgment result of the malicious codes with the similarity of the behavior characteristics. By using the invention, the malicious codes collected in a network can be subject to homology analysis, and a powerful support is provided for tracing of a subsequent attack source. The method can correctly reflects the homology among samples of the malicious codes, correctly differentiates the samples of the malicious codes without homology, and has important guidance and reference significances in analysis work of the homology of the malicious codes.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a malicious code homology analysis method based on behavior feature similarity. Background technique [0002] Malicious code refers to a set of instructions that run on a computer to make the system perform tasks according to the attacker's wishes. With the deep application of computer networks and the continuous development of malicious code technology, the harm caused by malicious code is becoming more and more serious, and it has become an important factor that threatens the security of computer systems. Malicious codes are executed on computers or other terminals without user authorization, achieving malicious purposes such as interfering with the normal operation of the host, destroying the integrity of stored data, and stealing users' personal privacy, seriously infringing on the legitimate rights and interests of the attacked. [0003] In recent years, with the e...

AI Technical Summary

Problems solved by technology

[0011] Most of the current malicious code homology analysis research relies on manual analysis. In the existing automated analysis methods, only static features such as malicious code signatures and control flow graphs are used as the basis for malicious code analysis, and it is impossible to analyze packed files. Malicious code samples, poor versatility

Images