基于层次关系分析的一种软件行为检测方法.pdfVIP

小型微型计算机系统 Journal of Chinese Computer Systems 2014 年 9 月第 9 期 Vol. 35 NO.9 2014 基于层次关系分析的一种软件行为检测方法 申利民，杨慧锋，马川，王涛 (燕山大学信息科学与工程学院河北省计算机虚拟技术与系统集成重点实验室，秦皇岛066(泊的 E-?Uül:yanglizhua且g87@ 163. com 摘 要:为了提高软件行为判定的精确性，提出了一种基于层次关系分析的软件行为检测方法.首先，截获系统调用并提取动 作特征，通过分析单一动作的我返回地址、动作名称、绑定关系，关键属性得到点内关系，通过分析动作间的依赖和传递关系得 到线闯关系，并将各动作组成任务;然后，分析各任务间控制分支点动作的控制承接关系得到网闯关系，进而利用这些层次关系 生成软件行为模型;最后，比对待检测行为是否符合模型中记录的各动作之间关系，做出行为是否有害的判定.实验和分析结果 表明:利用该方法能够准确描述动作流程，提高了检测准确度和效率. 关键词:软件行为:行为检测;系统调用;层次关系分析 中圄分类号:τ凹11 文献标识码 :A 文章编号: 1α)()-1220( 2014)ω-1949-?7 Software Behavior Detecti08 Method Based 08 Hierarchical Relati08 Analysis SHEN Li-min , YANG Hui-Feng ,MA Chuan ,WANG Tao ( College of Infonnation Science and Engineeri吨， Yanshan University/Compu阳 Virtual T，臼hnology System lnte阴阳n Key Laboratory of Hebei 阶ovince ， Qinhuangdao 066004 I China) Abstract : In order to improve 由e accuracy of so位ware behavior s judgment , this paper proposes a detection method based on hier缸- chica1 relation analysis of s。由ware behavior. Firstly ,it intercepts the sy臼m call and from which ex田.cts action characteristics , then ob- tains intemal relation by analyzing stack -return-address , action n缸ne ,binding relation and key attribute in a single action , obtains line relation by analyzing dependency and transitive relation between the two actions ,and some actions compose a task. Whats more , it ac- quires interconnect relation by analyzing 由e con位。l-order relation which among some different tasks. So the hierarchical relations con- struct so位ware behavior model. Finally ,it makes judgment 阳t whether the behavior is harmful or not 由at comparing the hierarchical relation of the upcorning behavior with the relation 扭曲e model. The experirnents and analysis results show that using 由is method can not on1y accurately describe 阳 action pr回邸，but also has improved the de能ction accuracy and applicability. Key words: so位ware behavior; behavior detection; system calls; hierarchical relation analysis 1 号|言 随着Intemet