基于代码覆盖的恶意代码多路径分析方法

Exploring Multiple Execution Paths for Malware Analysis Based on Coverage of Codes

传统的恶意代码动态分析每次分析的对象只是恶意代码的某一个执行路径,难以保证分析的全面性.恶意代码多路径分析是解决该问题的思路之一.本文提出一种基于代码覆盖的多路径分析方法,通过标识判断条件节点,减少局部路径被重复遍历的次数,在保证分析效果的同时,提高分析系统的分析效率以及代码覆盖率.通过对大量典型恶意代码的分析验证表明,本方法可明显缩短分析时间,提高分析效率和分析的全面性.

Currently, the problem of dynamic analysis of malicious code （or malware） is that only a single execution path is observed. It is potential to miss a significant fraction of the behavior that a program might exhibit under varying circumstances. To mitigate this problem, a number of analysis tools by way of exploring multiple execution paths have been proposed.In this paper, we propose a system by exploring multiple execution paths for malware analysis based on coverage of codes that can reduce the times of some paths explored and improve the analysis efficiency and increase the coverage of the malware by way of labeling control flow decision points （ branching points）. We evaluated our system on a large number of typical malware samples and demonstrate that we are able to reduce the time of analysis and improve the efficiency of analysis and increase the code coverage.