基于结构化指纹的恶意代码变种分析*

提出了一种基于结构化指纹的静态分析模型,用于辅助逆向工作者对恶意代码及其变种进行分析.该方法依据所提取的恶意代码及其变种的结构化指纹特征,在调用图和控制流图两个层次对两个文件进行同构比较,找出发生改变的函数以及发生改变的基本块,从而帮助逆向工作者迅速定位和发现恶意代码及其变种的不同之处,便于进一步分析.该模型采用了结构化特征及素数乘积等方法,可以较好地对抗一些常见的代码迷惑手段,从而识别出一些变形的代码是等价的.

Analysis of malicious code variants based on structural fingerprints

This paper presented a new static analysis model based on structural fingerprints to help reversing engineers analysing malicious code and its variant. Using structural fingerprints extracted from malicious code and its variant, this model carried on isomorphism of call graph and control flow graph to find changed functions and basic blocks, which gave enough information for the reversing engineers quickly locating the difference between the two files to do advanced research.Since using structural character and prime product, the model would not be confused by common methods of code obfuscation and could identify that some polymorphic codes were equivalent.