一种层次化的恶意代码行为分析方法.pdfVIP

Vo1.30 No .4 计算机应用 第 30 卷第 4 期 2010 年4 月 Joumal of Computer Applications Apr.20 1O 文章编号:1∞1-9081(2010)04 斗048 阳的 ~.J唱巨型、，1- r 1; .J..J.. :IT: .:::È!缸 I Il. γ;1 ;.- .l.L J飞~ -J.四、 一刊J器以悦，则芯思1\，响f丁~71相T 刀，束 黄荡，武东英，孙晓忻 (信息工程大学仿怠工穆学院.郑州 45创l(2) ( angeltelll币 14(gl伊nail. com) 捕 事:提出-‘种层次化的恶意代码行为分析方法，首先根据程序l!4t时的系统调用序列获取行为传息，然后分 析其行为1蓝图并作危害性伴佑。在行为检测部分，设计了行沟枪测算法，利用系统调用函数及其参数信息仅如l 稳序 行为。在行为分析部分，总结了各种总念行为对计算机系统造成的危害，利用攻击树尿理建立恶意行为危害评估模 型，并给出.f:念代码危害性计算方法。 关键询:行为分析;行为检剧;应用程序接口调用序列;层次化方法;攻击树 中图分类号: TP393.08 文献标志码:A Hierarchical method to analyze malware behavior HUANG Qian , WU Dong-ying , SUN Xiao-yan (Institute 01 Ir伪17TUJtion E愣山阴暗.， /，矿o17TUJtion E.时ineering University, Zheng加u Henan 45脱脱， Chùw.) Ab雷tract: 啊lis paper proposed a hierarchi盯al melhod to analyze malware behavior, which firstly ohtained behaviOf information according 10 the system calI sequence in the mn-time of the program , then analyzed their hehavioral intentions and made hazardω树ssments. On the part of behavior deteeti棚， a hehavior detection algorithm w邸 designed， which utilized system calIs and theír ar伊menls 10 identi行 the progr，刷n hehavior. On the part of behavior analysis. an evaluation m例如I about the harms of malicious actions was established on the basis of summarizing a variety of malicious actions and their harmsω computer syslem, together with a melh叫 being givenωevaluale the harm of theωde. Key words: behavior analysis; hehavior detection; Application Progr阳uni吨 Intenace