Method and system for judging homology of massive malicious samples

Abstract

The invention discloses a method and system for judging homology of massive malicious samples. The method comprises the following steps: decompiling the malicious samples to obtain smali files and extracting class names and method names; calculating simhash fingerprints of the malicious samples by taking a combination of the class names and the method names as a characteristic dimensionality; calculating Hamming distances between the simhash fingerprints of the malicious samples on the basis of a MapReduce mode; and determining the malicious samples, the Hamming distances of which are less than or equal to a preset threshold value, as homological samples, wherein the class names are names of abstract objects in program codes and the method names are function names contained in the abstract objects in the program codes. According to the method and system disclosed in the invention, homology analysis can be carried out on massive samples, so that the processing time is shortened, and the correctness of homology judgement is improved.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and system for judging homology of massive malicious samples. Background technique [0002] As early as 2011, Kaspersky pointed out in its analysis report that based on the fact that the two attack viruses of Stuxnet and Poison Zone contained part of the same code, it was inferred that they came from the same author, and since then, the homology detection of malicious code has been opened. Prologue with Judgment. However, the early detection methods were based on a large number of manual analysis, with low analysis efficiency and long work cycle; then, based on linguistics and computer reverse engineering technologies, the Charles River Analysis Company of the United States developed a malicious code analysis system, which traces code evolution. Discover the homology between malicious code samples, but this method is based on the intelligence analysis platf...

AI Technical Summary

Problems solved by technology

However, the early detection methods were based on a large number of manual analysis, with low analysis efficiency and long work cycle; then, based on linguistics and computer reverse engineering technologies, the Charles River Analysis Company of the United States developed a malicious code analysis system, which traces code evolution. Discover the homology between malicious code samples, but this method is based on the intelligence analysis platform Palantir, which cannot meet the general application conditions

In 2012, Guan Qiang and Liu Xing respectively proposed homology automatic determination technology based on the static characteristics of malicious code, but their methods did not take into account the processing of packed malicious samples

In 2013, Mandiant Corporation of the United States proposed the method of using malicious code characteristics to track the source of the attack to analyze homology, but this analysis requires long-term tracking of the target first, and the analysis period is long

In 2015, Kang Fei proposed to analyze the homology of malicious code based on the similarity of behavior characteristics, but it did not consider the context of behavior characteristics. It is obviously unreasonable to regard the same behavior in different environments as having the same characteristics and purpose.

[0004] 1. The earlier homology analysis methods were all based on the in-depth manual analysis of the captured samples, so it required a lot of manpower and time;

[0005] 2. Packed samples are not considered, and the technology lacks versatility;

[0006] 3. Among the current methods, there is no technology suitable for homology determination of massive malicious code samples

Images