基于攻击树的文件风险评估方法

通过对已有文献提出的恶意代码检测方法进行分析改进,提出一种基于行为的静态分析、动态监视和攻击树匹配相结合的文件风险评估的方法。根据文件类型分别从静态和动态两个方面对文件进行分析。通过对攻击树结点间的关系和结点属性进行扩展,能够更好地匹配和描述恶意代码的各种行为。应用多属性效用理论量化结点权重,使评估更加客观准确。实验表明,该方法能够较准确的量化文件的风险程度。

File Risk Assessment based on Expanded Attack Tree

Through analyzing and reforming the existing ways for malicious code detection a behavior-based file risk assessment method in combination with the technology of static analysis,dynamic monitoring and attack tree matching is proposed.Based on the file type,the file is analyzed from both static and dynamic aspects.By extending the relations between attack tree nods and attribute of these nodes,the various kinds of malicious conducts could be better matched and described.The multi-attribute utility theory is ...