基于行为分析和特征码的恶意代码检测技术

Technique of detecting malicious executables via behavioral and binary signatures

提出一种新的恶意代码检测技术,能自动检测和遏制(未知)恶意代码,并实现了原型系统。首先用支持向量机对恶意代码样本的行为构造分类器,来判断样本是否是恶意代码,同时对恶意代码提取出特征码。运行在主机的代理利用特征码识别恶意代码并阻断运行。为了精确分析程序行为,将程序放入虚拟机运行。实验结果表明,相对于朴素贝叶斯和决策树,系统误报率和漏报率均较低,同时分布式的系统架构加快了遏制速度。

This paper proposed a new approach that could effectively detect and restrict（unknown） malware,and implemented a prototype system.First,used support vector machine to build classifier,which could judge whether a program was malicious or not,and extracted the malware＇s signature.Agents running in host could detect malware and stop its execution.To analyze precise behaviors,put samples in virtual machines for executions.Experiment results show compared with naive Bayes and decision tree,our system yields low false positives as well false negatives,and the distributed architecture accelerates restriction.