A method for homology analysis of malicious code based on cross-process behavior monitoring

Abstract

The present invention proposes a method for homology analysis of malicious code based on cross-process behavior monitoring, by defining taint propagation rules, saving cross-process related log records, filtering, extracting, and comparing and analyzing log records, and tainting related operations judge. The present invention can not only record events directly and indirectly related to a certain file by creating different processes or inserting behaviors of remote threads; it can also record the program behaviors that are indirectly executed by exploiting loopholes, such as hijacking and executing by using dll ; At the same time, the number of recorded logs can be greatly reduced.

Description

technical field [0001] The invention relates to the technical field of computer applications, in particular to a method for homology analysis of malicious codes based on cross-process behavior monitoring. [0002] technical background [0003] The ever-increasing amount of malicious code poses a huge threat to the security of user equipment, privacy, and property. A large number of researchers have begun to focus on technologies such as malicious code detection, and have achieved certain results. Malicious code detection methods can be divided into two categories: static detection and dynamic detection. Static detection mostly uses reverse engineering techniques such as decompilation to extract application static features, such as signatures, functions, view structures, static data flow, control flow and other static features, combined with certain rule matching algorithms to detect malicious code; dynamic detection uses program The runtime behavior characteristics are the d...

AI Technical Summary

Problems solved by technology

However, they all have certain shortcomings. In the face of new malicious programs that continue to appear, static detection methods use known malicious program features to match, and the false positive rate is high, and it is impossible to detect some programs that download malicious code at runtime. application

However, dynamic detection requires the execution of malicious programs, which has low code coverage and whether malicious behaviors can be triggered. For malicious applications that require certain conditions to be triggered, the behavior track cannot be accurately extracted, resulting in a decrease in detection accuracy.

Images