摘要
文章提出了一种基于静态分析木马文件信息的方法,对比分析木马PE文件和正常PE文件静态信息的不同,提取木马特征。通过否定选择算法对未知PE文件静态特征与木马特征进行匹配,从而判断该文件是否是木马文件。实验证明,该方法对未知木马检测效果明显。
In this paper, a Trojan horse detecting method based on file＇s static attributes is proposed, comparing and analyzing the different of PE file static attribute between Trojan horse and normal, to abstract the feature of Trojan horse. Through negative selection method matching the unknown PE file＇s static attribute and Trojan＇s, to estimate whether it is a Trojan horse file or not. Furthermore, the effect of this method to unknown Trojan horse detection is obviously.
出处
《煤炭技术》
CAS
北大核心
2013年第7期154-156,共3页
Coal Technology
关键词
木马检测
否定算法
PE文件
静态属性
trojan horse detection
negative selection algorithm
PE file
static attribute
