摘要
网络空间中充斥着大量的恶意代码,其中大部分恶意程序都不是攻击者自主开发的,而是在以往版本的基础上进行改动或直接组合多个恶意代码,因此在恶意程序检测中,相似性分析变的尤为重要。研究人员往往单一种类的信息对程序相似性进行分析,不能全面地考量程序的有效特征。针对以上情况,提出综合考虑动态指令基本块集合的语义特征和控制流图的结构特征的程序相似性分析方法,从语义和结构两个维度对恶意程序相似性进行分析,具有较高的准确度和可靠性。
Most of malwares in cyberspace are not developed by the attacker,but based on the previous version to modify or directly combined from multiple malicious code.Therefore,similarity analysis is particularly important to detect malwares.Usually,only one single kind of malware characteristics is used to analyze the similarity of procedures,which can not fully identify the effective characteristics of procedures.So this paper proposes a program similarity analysis method which considers the semantic features of the basic block set of dynamic instructions and the structural features of the control flow graph.It analyzes the similarity of malicious programs from the semantic and structural dimensions,which can reach high accuracy and reliability.
作者
任益辰
肖达
REN Yichen;XIAO Da(School of Cyberspace Security,Beijing University of Post and Telecommunications,Beijing 100876,China;National Engineering Lab for Mobile Network Security,Beijing 100876,China)
出处
《计算机工程与应用》
CSCD
北大核心
2021年第1期118-125,共8页
Computer Engineering and Applications
基金
国家自然科学基金(61872836,61941114)。
关键词
恶意程序
相似性
语义特征
结构特征
malware
similarity
semantic features
structure features
