基于操作码序列的静态恶意代码检测方法的分析-analysis of static malicious code detection method based on opcode sequence.docxVIP

AbstractWiththewidespreadofthe networkandthedevelopmentprogressofcomputertechnology,computerinformationsecurityisfacingagreatthreat.Themaliciouscodeisthe culprit.Thegrowth ofmaliciouscodeandthedevelopmentofthetechnology,not onlywill bringmuchinconveniencetohumanlife,butalsomaketheenterprisesanduserssufferhugeeconomiclosses.Somecan evenharm thenationalinformationsecurity.With the development and confrontation of malicious code detection andanti-detectiontechnology,thedailyproductionofalargenumberofnewmaliciouscodesbringstremendouspressurestoanalysts.Today,maliciouscodedetectioncapabilitieshavebeenfarinsufficientfordemand.Maliciouscodedetectiontechnologyisdividedintotwoapproaches,staticanddynamic.Thestaticdetectiongetstheresultbasedonthecontentandstructureofthecode,butthedynamicdetectionisbyexecutingcodeinavirtualenvironment.However,withthedevelopmentofcodeobfuscationtechniques,somestaticdetectionmethodsarefacingachallenge.Somemaliciouscodescanhidetheirmaliciousbehaviorstoevadedetectioninvirtualenvironment.Therefore,howto deal withtheexplosionofmaliciouscode,especiallyinresponsetothevariationsofmaliciouscode,becomesthefocusoftheresearchofmaliciouscodedetectiontechnology.Inthispaper,weproposeanewmethodofstaticmaliciouscodedetectionbasedontheopcodesequences.Thismethodextracts theopcodesequencesthroughthe program’s controlflowgraphasthecharacteristic,whichisdifferentfrom othermethods.Firstly,shell maliciouscodes.Secondly,thedisassemblyofmaliciouscodes,thenbuildtheprogram’scontrolflowgraphbywritingpluginandextractopcodesequences.Thirdly,extractthecharacteristicsusingn-gramalgorithmandselectfeaturesusinginformationgainanddocumentfrequencymethods.Finally,detectthemaliciouscodeusingmachinelearningclassificationalgorithmssuchasK-NearestNeighbor,DecisionTreeandSupportVector Machine.Intheexperiment,we choosethe different numberoffeaturesandothermethodstocomparetheexperimentalresultsbasedonthecorrectrate,therateoffalsepositive,therateoffalsenegative.Itcancome toaconclusionthat