基于层次关系分析的一种软件行为检测方法

Software Behavior Detection Method Based on Hierarchical Relation Analysis

为了提高软件行为判定的精确性,提出了一种基于层次关系分析的软件行为检测方法.首先,截获系统调用并提取动作特征,通过分析单一动作的栈返回地址、动作名称、绑定关系,关键属性得到点内关系,通过分析动作间的依赖和传递关系得到线间关系,并将各动作组成任务;然后,分析各任务间控制分支点动作的控制承接关系得到网间关系,进而利用这些层次关系生成软件行为模型;最后,比对待检测行为是否符合模型中记录的各动作之间关系,做出行为是否有害的判定.实验和分析结果表明:利用该方法能够准确描述动作流程,提高了检测准确度和效率.

In order to improve the accuracy of software behavior＇s judgment, this paper proposes a detection method based on hierarchical relation analysis of software behavior. Firstly ,it intercepts the system call and from which extracts action characteristics ,then obtains internal relation by analyzing stack-return-address,action name,binding relation and key attribute in a single action, obtains line relation by analyzing dependency and transitive relation between the two actions,and some actions compose a task. What＇s more,it ac- quires interconnect relation by analyzing the control-order relation which among some different tasks. So the hierarchical relations con- struct software behavior model. Finally,it makes judgment that whether the behavior is harmful or not that comparing the hierarchical relation of the upcoming behavior with the relation in the model. The experiments and analysis results show that using this method can not only accurately describe the action process,but also has improved the detection accuracy and applicability.