Malicious code detection system

Abstract

The invention discloses a malicious code detection system. The malicious code detection system comprises a code format recognition module, a static analysis module, a dynamic behavior analysis moduleand a code behavior monitoring module, and further comprises a code behavior predicting module, a code recognition and judgment module and a record extracting module, wherein the code format recognition module is used for recognizing and analyzing a format of a to-be-detected code, the static analysis module is used for obtaining an API function calling sequence, elements and resources of the to-be-detected code to construct feature vectors of the to-be-tested code, the dynamic behavior analysis module is used for analyzing the behaviors of the code through a built multistate response code behavior analysis model, and the code behavior monitoring module is used for transcribing code behavior data in the mode of script transcribing. By means of the malicious code detection system, maliciouscodes are detected based on the static mode and the dynamic mode, the malicious codes of new types can also be monitored, and a malicious code feature database and a malicious behavior feature database are automatically updated.

Description

technical field [0001] The invention relates to the field of data security, in particular to a malicious code detection system. Background technique [0002] With the explosive growth of malicious code, malicious code has become the biggest cause of personal and corporate information leakage, so it is necessary to detect malicious code before it runs. At present, there are relatively mature malicious code detection technologies, mainly based on signatures, signatures, and heuristics. [0003] The signature-based malicious detection method generates a mark for various malicious codes, and uses these marks to construct a malicious code database. This method can quickly detect whether a piece of code is malicious code, and has a high accuracy rate for the types of samples already in the database. It is the main method adopted by many commercial antivirus software. [0004] However, this method has the following disadvantages: the marking of malicious codes requires manual ext...

AI Technical Summary

Problems solved by technology

[0004] However, this method has the following disadvantages: the marking of malicious codes requires manual extraction by domain experts; a new malicious code may not include any known features, and can only detect existing malicious codes, but cannot detect new types malicious code for

Images