恶意代码行为获取的研究与实现

Research and implementation of obtaining malicious code behavior

分析对比了恶意代码的静态分析方法和动态分析方法,设计并实现了一种结合虚拟机技术和Windows操作系统自身所具有的调试功能来获取恶意代码行为的模块,该模块能够自动控制虚拟机运行监控程序来获取恶意代码的行为,并通过引入基于信息增益的特征权重算法来获得行为特征。

Based on the analysis and comparison of the malicious code static analysis and dynamic analysis methods, the authors designed and implemented a module through putting forward a combination of virtual machine technology and Windows operating system which had its own debugging function to obtain the behavior of malicious code, the module could automatically operate a virtual machine to run a monitoring program to obtain the behavior of malicious code, and got behavior feature by features weight algorithm based on information gain.