恶意代码的函数调用图相似性分析

恶意代码的相似性分析是当前恶意代码自动分析的重要部分。提出了一种基于函数调用图的恶意代码相似性分析方法，通过函数调用图的相似性距离ＳＤＭＦＧ来度量两个恶意代码函数调用图的相似性，进而分析得到恶意代码的相似性，提高了恶意代码相似性分析的准确性，为恶意代码的同源及演化特性分析研究与恶意代码的检测和防范提供了有力支持。

Similarity analysis of malware’s function-call graphs

The similarity analysis of malware is an important part of the current automatic analysis of malware. The paper proposes a new method of similarity analysis of malware based on function call graphs. This method uses the similarity distance of malware’s function-call graphs (called SDMFG) to measure the similarity of two malwares’ function-call graphs, and then analyzes the similarity of the two malwares. This method improves the accuracy of similarity analysis of malware, providing a strong support for analysis of the homology and evolution characteristics of malware and malware detection and prevention.Key words: