隐式API调用行为的静态检测方法

Static Detection Method for Obfuscated API-calling Behavior

为有效提取恶意程序及其变种中的隐式API调用行为,提出一种基于静态分析的隐式API调用行为检测方法。采用指令模板匹配的方法识别具体调用形式,通过分析调用目标地址与函数名之间的关系来识别被调用API函数。实验结果表明,该方法能提高静态分析工具对恶意代码及其变体的检测能力。

To extract API-calling behaviors from malware and their variants effectively,this paper proposes an approach to statically detect the obfuscated API-calling behaviors in Windows platform.In this approach,instruction pattern matching is used to recognize the special calling manner.The relationship between the targets of call instructions and the name strings of API functions is analyzed to identify which API function is called actually.Experimental results show that using this approach can improve detection ability of static analysis tools through static analysis.