基于离线汇编指令流分析的恶意程序算法识别技术

Malware algorithm recognition based on offline instruction-flow analyse

识别二进制程序中的算法,在恶意程序检测、软件分析、网络传输分析、计算机系统安全保护等领域有着广泛的应用和重要的意义。该文提出基于离线汇编指令流分析的恶意代码算法识别技术,综合运用二进制插桩、污点跟踪、循环识别等技术,从行为语义、关键常数2个维度对程序进行描述,并且分析提取特征。算法识别模型使用机器学习算法,针对双维度特征生成初阶识别模型,并通过模型融合优化识别效果,实现对广义程序算法的高准确率识别。

Binary program algorithm identification is widely used for malware detection, software analyse, network encryption analyse and computer system protection. This paper describes a malware algorithm recognition method using offline instruction flow analyses using binary instrumentation, taint traces, and loop recognition. The algorithm features are described including the behavior semantics and key constants extracted from the instruction-flow algorithm. Two machine learning models trained by these features are merged into one accurate recognition algorithm.