针对指令乱序变形技术的归一化研究.pdfVIP

计算机科学2008Vol. 35 Na. 2 针对指令乱序变形技术的归…化研究 金然魏强 3巨滑贤 (信息工程大学信息工程学院 郑州 450002) 摘 要 新出现的恶意代码大部分是在原有恶意代码基础上修改转换而来。许多变形恶意代码是能自动究成该过 穆，由于其特征码不罔定，给传统的基于特征码检测j 乎段带来了极大挑战。采用归…化方法，并结合使用传统检测技 术是一种应对思路。本文针对指令乱序这种常用变形技术提出了相应的归一化方案。该方案先通过控制依赖分析将 待测代码划分为若干基本控制块，然后依据敬据依赖回调整各基本控制决中的指令顺序，使得不同变种经处理后趋向 于一致的规珑形式。该方案对指令乱序的两种实现手段，即跳特法和非跳转法，同时有效。最后通过模拟测试对该方 案的有效性进行了验证. 提键词 变形恶意代码，归卢化，恶意代码检测 R帽倒rch 00 Nonnalization towards Instructions Rωrderiog Metarnorphism Technique JIN Ran WEI Qiang WAN Qing-Xian (1nfonnation Engineering Institute ,Infonnatíon Engineering University , Zhengzhou 450002) Abstract Much of apparently new malware comes from transformed known malware. Metarnorphic malware could e- venωmplete this process automatically. The mutable signature makes the traditional detection method based on it diffi- cult to detect metamorphíc malware. Combiníng normalization idea with the traditional detection technology is a prom- ising approach ωresolve the problem. Thís paper proposes a normalization scheme towards ínstructions reordering metamorphism technique. ln the scheme , the inspected ∞de is firstly partitioned into some basic ∞ntrol blocks based on control-dependency analysis. then the instructions order in each block is adjusted accordíng to the data-dependency graph. After the variants of malware are normalízed according to the scheme , they tend to have the same fo rm. The scheme is applicable to both jump method and non-jump method whích are two implementations of instructíons reorde- ring. Testing has been conducted ωvalidate the feasibility of the scheme. Keywor也 Metamorphic malware , Normalization , Malware detection