The application discloses a malicious code semantic
perception static detection method and
system and a storage medium, and belongs to the technical field of cyberspace security. In view of the problems of poor anti-
confusion ability of existing regular matching technology and high
false alarm rate caused by the inability to distinguish RCE attacks from DoS abnormalities, the application proposes a solution based on an abstract
stack machine and a taint analysis. The method first extracts a serialized operation code sequence, simulates stack behavior by using an abstract
stack machine and a sentinel mechanism to restore instruction structure; secondly, in combination with a semantic environment
knowledge base, a reflective call is deeply deduced, and obfuscated code is restored to real
semantics; finally, based on a four-state taint analysis model, a judgment strategy of triggering an alarm only when a high-risk function is called and the parameters contain taint data is implemented. The application can effectively
resist Fickling and other advanced
obfuscation attacks, accurately filter non-malicious program
noise, and significantly improve the accuracy and anti-interference ability of model security detection.