Malicious code detection method and system based on kernel object behavior body

Abstract

The invention relates to a malicious code detection method and system based on a kernel object behavior body, and belongs to the technical field of a computer. The method comprises the following steps of building a malicious family public behavior body; building a suspicious sample individual behavior body; importing the suspicious sample individual behavior body into the malicious family public behavior body to form a malicious code field body; reasoning the individual behavior body; and judging whether the individual behavior body is malicious code or not. The method and the system have the advantages that the method is simple and reliable; a suspicious sample can be detected and classified through building the body; the relationship between two objects and the operation condition of the two objects can be directly seen from a kernel object behavior graph; and the detection and classification effect on the malicious code is good.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a malicious code detection method and system based on kernel object behavior ontology. Background technique [0002] In the prior art, there are mainly the following methods for malicious code detection: [0003] (1) System call-based method: this method uses the system call API as a feature, and performs various processing on the system call API to detect malicious code. Problems and defects in this method: Most of the harmful behaviors caused by malicious code are done by manipulating kernel objects, and kernel objects can only be used by the system kernel, and simple system call attacks cannot affect the kernel. object. Consider all system calls, and most of these system calls are used by malicious code to confuse detection, making detection more imprecise. And many malicious code writers have added a large number of system call execution sequences to hide the attack of m...

AI Technical Summary

Problems solved by technology

Problems and defects in this method: Most of the harmful behaviors caused by malicious code are done by manipulating kernel objects, and kernel objects can only be used by the system kernel, and simple system call attacks cannot affect the kernel. object

Existing technical problems and defects: The average deceleration factor of Taintcheck is 24, and the performance is not very good

[0005] (3) Based on the system call graph or the traditional kernel object behavior graph: the system call graph reflects the call relationship between the system call API, that is, the call relationship between function operations. The traditional kernel object behavior graph is the kernel object The existing problems and defects are: the system call diagram cannot reflect the operation situation between which two objects, and the traditional kernel object behavior diagram cannot reflect the operation situation of the object, making the malicious code Detection is not accurate enough

Images