基于动态行为指纹的恶意代码同源性分析.pdfVIP

2016 年 7 月 四川大学学报(自然科学版) Ju l. 2016 第 53 卷第4 期 Journal of Sichuan University (Natural Science Edition) Vo l. 53 No.4 doi: 103969/j. issn. 0490-6756. 2016. 07. 016 基于动态行为指纹的恶意代码同源性分析 郑荣锋，方勇，刘亮 (四川大学电子信息学院，成都 610065) 摘 要z 针对恶意代码在网络空间中呈爆发式增长，但多数是已有代码变种的情况。通过研 究恶意代码行为特征，提出一套新的判别恶意代码同源性的方法.从恶意代码行为入手，提取 恶意代码行为指纹，通过指纹匹配算法来分析恶意样本是否是已知样本的变种.经研究分析， 最终筛选 3 种特征来描绘恶意软件的动态行为指纹:一是字符串的命名特征;二是注册表的变 化特征;三是围绕关键 API 函数的调用顺序的特征.通过指纹匹配算法计算不同恶意代码之 间的相似性度量，进行同源性分析.实验结果表明，该方法能够有效地对不同恶意代码及其变 种进行同源性分析. 关键词:恶意代码;同源性;动态行为;指纹特征 中固分类号: TP309 文献标识码:A 文章编号: 0490-6756(2016)04-0793-06 Homology analysis of malicious code based on dynamic-behavior fingerprint ZHENGRong-Feng , FANGYong , LIULiang (College of Electronics and Information Engineering , Sichuan University , Chengdu 610065 , China) Abstract: With the explosive growth of malware in cyberspace , many malicious samples are just varia- tions of previously encountered samples. This paper presents a novel approach to investigate the homol- ogy of malware based on dynamic-behavior characteristics. To distinguish whether a malware is varia- tion , researchers extract the fingerprint among malwares , then use fingerprint matching algorithm to analyze similarity between them. Researchers select three different characteristics as malware finger- print: the characteristic of the name strings , the characteristic of register changes , and the characteristic of the function sequence around key API calls. Finally , researchers compute the similarity value of dif- ferent malwares to analyze the homology of malwares. Experiments show that this approach is effective to analyze the homology of malware. Key word