Malicious code behavior feature extraction method

Abstract

The invention discloses a malicious code behavior feature extraction method. The method comprises the following steps of 1, performing disassembling analysis on a malicious code sample by using a disassembling tool through adopting a static analysis method to obtain a function call graph and a control flow graph; 2, performing optimization processing on the function call graph and the control flowgraph, generating an executable path set, and allocating a dynamic analysis node to each path; 3, through a dynamic analysis tool, performing dynamic analysis by using an automatic single-step debugging method, enabling a program to be executed according to a control flow sequence of executable paths obtained by static analysis, and obtaining an API call correlation of a malicious code; and 4, according to API call correlation analysis, obtaining a behavior feature value of the malicious code. A behavior feature of the code can be represented more accurately, so that the analysis and detection of the malicious code are more accurate.

Description

technical field [0001] The invention relates to the technical field of information security and the field of file systems, in particular to a method for extracting malicious code behavior characteristics. Background technique [0002] With the rapid development of the Internet, the number of terminal devices connected to the network and Internet applications have exploded. The popularity of the Internet has also accelerated the spread of malicious codes. Malicious codes have become an important issue in the field of software security. In order to improve the survivability of malicious code, its creators usually use malicious code obfuscation technology, so that new variants appear every time it is spread, making it more difficult to detect malicious code. [0003] Malicious code detection methods can be divided into two categories: heuristic-based detection and feature-based detection. The heuristic-based detection method judges the possibility of malicious code according to...

AI Technical Summary

Problems solved by technology

In order to improve the survivability of malicious code, its creators usually use malicious code obfuscation technology, so that new variants appear every time it is spread, increasing the difficulty of malicious code detection

Images