Malicious applications can be introduced to attack users and services so as to gain financial rewards, individuals＇ sensitive information, company and government intellectual property, and to gain remote control of s...Malicious applications can be introduced to attack users and services so as to gain financial rewards, individuals＇ sensitive information, company and government intellectual property, and to gain remote control of systems. However, traditional methods of malicious code detection, such as signature detection, behavior detection, virtual machine detection, and heuristic detection, have various weaknesses which make them unreliable. This paper presents the existing technologies of malicious code detection and a malicious code detection model is proposed based on behavior association. The behavior points of malicious code are first extracted through API monitoring technology and integrated into the behavior; then a relation between behaviors is established according to data dependence. Next, a behavior association model is built up and a discrimination method is put forth using pushdown automation. Finally, the exact malicious code is taken as a sample to carry out an experiment on the behavior＇s capture, association, and discrimination, thus proving that the theoretical model is viable.展开更多
基金supported by the National Natural Science Foundation of China (Nos. 61272033 and 61272405)
文摘Malicious applications can be introduced to attack users and services so as to gain financial rewards, individuals＇ sensitive information, company and government intellectual property, and to gain remote control of systems. However, traditional methods of malicious code detection, such as signature detection, behavior detection, virtual machine detection, and heuristic detection, have various weaknesses which make them unreliable. This paper presents the existing technologies of malicious code detection and a malicious code detection model is proposed based on behavior association. The behavior points of malicious code are first extracted through API monitoring technology and integrated into the behavior; then a relation between behaviors is established according to data dependence. Next, a behavior association model is built up and a discrimination method is put forth using pushdown automation. Finally, the exact malicious code is taken as a sample to carry out an experiment on the behavior＇s capture, association, and discrimination, thus proving that the theoretical model is viable.
