Script virus detection method and system based on program keyword calling sequence

Abstract

The invention provides a script virus detection method and system based on a program keyword calling sequence. A program to be detected is subjected to lexical analysis and syntax and semantic analysis, called script program keyword information and a semantic type mnemonic symbol are marked, the keyword information and the mnemonic symbol are stored in a data stream to be detected, the data stream to be detected is matched with a feature string extracted from a malicious script in advance, and the program to be detected is judged to be malicious if the data stream to be detected can be successfully matched with the feature string. The method disclosed by the invention abandons a variable name and the like in the program, carries out mode matching through the code program keyword calling sequence, can effectively confront the polymorphic deformation of the malicious script and can effectively reduce a feature amount in a feature library and reduce disk usage through a mode matching way.

Description

technical field [0001] The invention relates to the field of network security, in particular to a script virus detection method and system based on program keyword call sequences. Background technique [0002] Scripting language is a computer programming language created to shorten the traditional writing-compiling-linking-running process. It is interpreted and executed sentence by sentence by the corresponding interpreter. It is simple, easy to learn and use, and is currently widely used in Internet web page development The more popular scripting languages ​​are javascript and vbscript. Malicious script programs are script programs aimed at damaging system functions and spreading maliciously. This part of the program is embedded in normal web page programs and is difficult to be detected. When users browse web pages infected by malicious scripts, other malicious codes are automatically downloaded to Other script code that resides on the user's computer or infects the user'...

AI Technical Summary

Problems solved by technology

At present, most malicious scripts use complex polymorphic deformation technology in order to fight against antivirus software. For example, part of the script deformation uses useless characters such as adding spaces and newlines, or the variable names used in the script program are defined by random strings. Equivalent transformation, etc., which brings great difficulties to the method of static code detection, resulting in a sharp increase in the feature quantity of the detection module, and a continuous decrease in the detection rate, which gave birth to the detection method after virtual execution. The advantage of the method is that through virtual execution, the deformed code of the malicious code is decrypted, and the real malicious function part is obtained, and then the static pattern matching method is used for matching. This method does improve the detection ability of malicious scripts, but due to the The efficiency is very low, and it is difficult to find a consistent method to decrypt all malicious scripts. Usually, each malicious transformation technology needs to implement a set of script virtual execution decryption modules, which is difficult to develop and high in daily maintenance costs. Not widely used in virus software

Images