摘要
恶意代码在网络中传播时不会表现出恶意行为,难以通过基于行为的检测方法检测出。采用基于特征的方法可以将其检测出,但需要进行网络包还原,这在大流量时对网络数据包进行还原不仅存在时空开销问题,且传统的特征提取方法提取的特征往往过长,容易被分割到多个网络数据包中,导致检测失效。本文提出非包还原恶意代码特征提取,采用自动化与人工分析相结合、基于片段的特征码提取,以及基于覆盖范围的特征码筛选等方法,实验结果表明,对恶意软件片段具有一定识别能力。
The popularity of the network has brought great convenience for the dissemination of malicious code. Because malicious code in the network communication does not show any malicious behavior, it is difficult to detect their spreading using behavior-based detection methods. Signature detection methods can be used to detect malicious code spreading, but, not only data packets reducing requires time and space cost tradeoffs in the large flow network, but also, the malicious code signatures extracted from traditional metfiods are often too long, and the signatures are easily split into multiple network packets, resulting in failure detection. Malicious code detection method based on non - packet reducing （NPR Based Malware Signature Extraction Method）proposed in this paper, to a certain extent solved the above problems. Experiment results show that the proposed NPR method has good results in detecting small fragments of malicious code.
基金
国家863项目资助(编号:2009AA01Z435
2009AA01Z403)
关键词
特征码提取
非包还原方法
恶意代码检测
signature extraction
non-packets-reducing method
malware detection
作者简介
王光卫（1959-）,男,学士,工程师.
陈健（1985-）,男,硕士,工程师.｜
范明钰（1962-）,女,博士,教授.
