Malicious code detection method and system

Abstract

The invention provides a malicious code detection method and system. The malicious code detection method comprises the following steps: analyzing a structure of a to-be-analyzed sample object; when the to-be-analyzed sample object is of a PE executable stylistic structure, performing static analysis, antivirus software interface analysis, dynamic virtual environment sandbox analysis and network data analysis on the to-be-analyzed sample object and obtaining a first analysis result; when the to-be-analyzed sample object is of a text structure, performing static analysis on the to-be-analyzed sample object and obtaining a second analysis result; detecting whether a malicious code exists or not by adopting a malicious code classifier according to the first analysis result or the second analysis result. In the whole process, data structures of different sample object types are analyzed; static analysis, antivirus software interface analysis, dynamic virtual environment sandbox analysis and network data analysis are adopted; the analysis and identification abilities are reliable, and a source of a network attack incident can be traced.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a malicious code detection method and system. Background technique [0002] In the context of the big data era, traditional anti-malware software vendors use a single technology. With the development of malicious code technology, APT (Advanced Persistent Threat, Advanced Persistent Threat) organizations are able to carry out continuous hacker penetration activities. , The form of malicious code tools has also undergone major changes, and the products of traditional anti-virus vendors have been unable to meet and deal with the existing threats of malicious code attacks. [0003] As the network environment becomes more and more complex, it faces more and more security threats from uncertain factors. The penetration method that advanced malware mainly considers and the very active attack method is the organized spear phishing attack target network through email malicious p...

AI Technical Summary

Problems solved by technology

[0005] Based on this, it is necessary to provide a malicious code detection method and system with a good detection effect for the problem of poor detection effect of general malicious file detection methods

Images