Malicious software identification method, system and device and readable storage medium

Abstract

The invention discloses a malicious software identification method, which comprises the following steps: obtaining an executable file of software to be identified, and extracting binary instruction characteristics in the executable file; performing feature matching on the binary instruction features in a feature library to obtain corresponding same features and / or similar features; and judging whether the to-be-identified software is malicious software or not according to the properties of the same features and / or similar features. Because the control flow diagram is an abstract data structure of the minimum control logic in the program execution process, the binary instruction feature obtained by splicing and combining the binary instructions according to each control flow diagram has smaller granularity than the function, and the real-time execution process of the control flow of the function can be reflected; therefore, similarity matching is carried out by utilizing the binary instruction characteristics of the executable file, and the malicious software identification precision can be obviously improved. The invention also provides a malicious software identification system and device and a readable storage medium, which have the above beneficial effects.

Description

technical field [0001] The present application relates to the field of malicious identification, in particular to a method, system, device and readable storage medium for identifying malicious software. Background technique [0002] With the wide application of software in various fields of society, more and more people pay more and more attention to software security. Establishing a trusted software system has become an effective means of maintaining information security, and detection of malicious software has become the core research direction of software credibility analysis. [0003] However, most of the existing malware identification methods use function as the granularity to perform similarity matching. If malware only reuses a small piece of code, it is difficult to identify it, resulting in low accuracy of malware identification. [0004] Therefore, how to improve the accuracy of malware identification is a technical problem that those skilled in the art need to s...

AI Technical Summary

Problems solved by technology

[0003] However, most of the existing malware identification methods use function as the granularity to perform similarity matching. If malware only reuses a small piece of code, it is difficult to identify it, resulting in low accuracy of malware identification.

Images