A Linux platform malicious software detection method

Abstract

The invention provides a Linux platform malicious software detection method. The method comprises the steps of disassembling benign software and malicious software samples of the ELF format by using an objdump-D command and generating assembling files; traversing the generated assembling files one by one, reading code segments in the ELF files and at the same time identifying whether the code segments contain main functions; analyzing the read code segments and performing division of basic blocks each of which is marked by using the lowermost address therein, adding peaks in a control flow diagram to adjacent linked lists, establishing the connection between the basic blocks, and adding edges of the control flow diagram to the adjacent linked lists to generate a basic control flow diagram; extracting the features of the control flow diagram and writing the features into an arff file; using the generated arff file as a machine learning tool weka data set, performing data mining and constructing a classifier; classifying the to-be-tested ELF samples by using the classifier. The method does not need to compare bulky feature libraries directly, is higher in speed and can detect unknown malicious software.

Description

technical field [0001] The invention relates to the technical field of computer malicious software detection, in particular to a malicious software detection method applicable to the ELF format of a Linux operating system. Background technique [0002] Malicious software refers to software that damages the user's computer and infringes the user's legitimate rights and interests without the user's permission, including viruses, worms, and Trojan horses. In recent years, malicious software has been rampant, seriously affecting the work and life of users. According to the research report of domestic security vendor 360, in 2014, a total of 324 million malicious program samples were added, with an average of 888,000 new malicious program samples per day, 57.27 billion malicious program attacks were intercepted, and an average of about 157 million malicious program attacks were intercepted per day Second-rate. [0003] The Linux operating system is a completely open operating s...

AI Technical Summary

Problems solved by technology

[0006] The technical problem to be solved by the present invention is to provide a Linux platform malware detection method, which solves the problem that the detection method based on code features cannot detect new or unknown malware, the size of the feature library and the matching time index of the feature increase and the need to continue in time The updated problem of applying machine learning methods to detect malware

Images