摘要
为了自动智能检测出新变种的恶意程序,使用虚拟执行与应用程序接口钩子技术,分析程序执行中调用的系统接口,将接口调用顺序编码形成一个特征序列。运用编辑距离算法计算程序特征序列与数据库中恶意特征序列的相似度,实现自动判别恶意种类的功能。在随机选取样本的的前提下,本系统对样本分析后结果表明,检测识别精确度达到92%,误报率仅为6%。
In order to automatically detect new varieties of malicious program efficiently,based on virtualization and API hook technology,analyzing the system interface call in program execution,a character sequence is formed from coding this process.The system then use Levenshtein Distance algorithm to determine the vicious procedures.System verification results from randomly selected samples show that the detection accuracy is reached a high recognition rate of 92%and low false alarm rate of 6%.
出处
《西安邮电大学学报》
2014年第2期77-81,共5页
Journal of Xi’an University of Posts and Telecommunications
基金
陕西省信息化建设重点基金资助项目(2011AQ01YA04-09)
关键词
接口钩子
虚拟化
恶意程序检测
编辑距离算法
API hook
virtual
malicious executables detection
levenshtein distance
