Linux系统中基于多路径的恶意行为规范挖掘

Linux恶意代码检测是Linux安全框架的一个重要组成部分。大多数现存的依照特征进行检测的方法通常落后于恶意代码的发展,已经不能满足日益迫切的安全需求,而基于行为的检测器往往需要高质量的恶意行为规范。使用了一种基于系统调用的自动挖掘规范技术,并在此基础上开发恶意代码的多执行路径,使其规范更详细更全面,从而提高检测器的检测率。

Mining Specifications of Malicious Behaviors Based on Multiple Paths in Linux

The malware detection is one of the important parts in a secure Linux frame.Most existing malware detection methods are based on the signature and generally leave behind the development of the malware technology, which cannot meet the ever increaing needs of security.Behavior-based detectors require high-quality specifications of malicious behavior.This paper introduces an automatic technique to mine specifications of malicious behavior based on system calls and explores multiple execution paths for malware specifications, which helps the specifications to be more specific and more comprehensive, and improves the rate of detection of the behavior-based detectors.