A malicious code homology analysis method based on system call control flow graph

Abstract

The invention discloses a malicious code homology analysis method based on a system call control flow diagram. Firstly, a system call control flow diagram of a program to be analyzed is constructed. The system call control flow graph is a directed unweighted graph composed of system call nodes, and the direction of edges indicates the order of system call execution. The system call control flow diagrams of different programs to be analyzed are compared to realize homology analysis according to the similarity of the diagrams as a similarity measure of homology analysis. The invention utilizes the system call control flow diagram to carry out homology analysis, and the system call control flow diagram completely ignores the details of the software code and only pays attention to the called system call function, thus simplifying the amount of data to be processed, and therefore, the control flow diagram based on the system call has the best abstraction degree to the program behavior. Moreover, because only system calls are considered, the confusion of instruction layer is avoided to a large extent, and the anti-confusion effect is achieved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a malicious code homology analysis method based on a system call control flow graph. Background technique [0002] The number of malicious codes has increased significantly, but most of the new malicious codes are variants of existing malicious codes, and their core functions have not changed much. Malicious code variants often use obfuscation techniques to evade virus detection and attack. [0003] Homology first refers to the degree of similarity between the nucleotide sequences of two nucleic acid molecules or the amino acid sequences of two protein molecules in the study of molecular evolution. Homology analysis applied to the software field refers to comparing two software from source code to software function to find out whether they are the same or similar, and give a similarity degree to describe the similarity of the two software. [0004] The homology analysi...

AI Technical Summary

Problems solved by technology

[0005] Commonly used behavioral feature representation methods include instruction block control flow graph, function call graph, etc. The above several behavioral features will produce a certain amount of changes after the introduction of polymorphism, deformation and other obfuscation techniques, so the homology analysis of malicious code variants Poor ability

Images