摘要
针对恶意程序使用反虚拟执行技术,分析人员在虚拟环境中不能检测到恶意行为的问题,提出了基于关键点复用的恶意行为检测方法。首先通过静态分析,检测程序中的反虚拟执行关键点;提取程序动态运行时调用的API函数,并在程序运行至关键点时创建当前快照;最后,当运行至路径结束点时通过关键点复用运行另一路径。实验结果表明,该方法能有效对抗恶意程序采用的反虚拟执行技术,从而检测恶意行为。
A malicious behavior detection method based on critical points reuse is proposed in order to solve the problem that analysts can not detect malicious behaviors in virtual environment when anti-virtual execution technology is used by a malware. Firstly, the method detects anti-virtual execution critical points through static analysis, then captures critical API functions when the program runs in virtual environment and creates snapshots at the critical points, and finally, executes a different path through critical point reuse at the end of the path. The experimental results demonstrate that the proposed method can effectively resist anti-virtual execution technologies in malwares and detect malicious behaviors.
出处
《信息工程大学学报》
2013年第5期624-628,共5页
Journal of Information Engineering University
基金
河南省重大科技攻关专项(092101210500)
关键词
恶意程序
虚拟环境
反虚拟执行
关键点复用
恶意行为
malware
virtual environment
anti-virtual execution
critical points reuse
malicious behaviors
