自动的恶意代码动态分析系统的设计与实现.pdfVIP

2009 7 7 Journal of C inese Comput er Syst ems Vol. 30 No. 7 2009 1 2 管云涛, 段海新 1( , 100084) 2( , 100084) E-mail: guanyt06@ mails.tsing ua. edu. cn : 现代的恶意代码采用多态和加壳等方法来隐藏自己, 使得恶意代码的分析检测变得越来越困难. 统的手工分析需要 耗费大量时间和人力, 不能满足恶意代码分析的需要. 本文设计实现的自动化恶意代码动态分析系统MwDAS , 可以自动地对 恶意代码样本进行快速的动态分析, 通过Kernel Hooking 和Filter Driver 技术在内核态提取其行为特征, 生成详细的分析报告. 实验结果表明M wDAS 可以提高恶意代码的分析效率. : ; ; ; : T P393.08:A : 1000-1220(2009) 07-1326-05 Design and Implementation of an Automated Malware Dynamic Analysis System 1 2 GU AN Yun-tao , DUAN Hai-xin 1( D ep art ment of Comp ut er S cience T echnology , T s ing hua Unive rs ity , Beij ing 100084, China) 2( N e tw or k R ese arch Center , T s ingh ua Univ er si ty , Beij i ng 100084, Ch ina) : , , Abstract Wit t e application of polymorp ism metamorp ism and packing tec niques t e analysis and detection of modern malware becomes more difficult . Manual malw are analysis fails to andle t is situation due to it s unacceptable cost and uman force involvem ent . T e aut or design and implement an automat ed malware dynamic analysis system named M wDAS using kernel ooking and filt er driver tec nologies, w ic can aut omatically analyze malware sample, extract and detail malw areøs - . . be aviors into a w ell organized report T e experiment s ow s t at Mw DAS can dramatically improve t e analysis efficiency Key words: dynamic analysis; static analysis; malware; netw ork security 1 Mw DAS, , - , Hook ,