动态指令流差分分析在恶意软件分析中的应用*

针对静态分析方法已不能满足安全分析的需求,而传统的动态分析技术不能快速定位关键信息,且分析效率不高,提出了一种动态指令流差分分析技术,描述了差分分析模型和分析方法。该分析技术能够高速有效地分析恶意软件的关键数据,识别加密算法,分析混淆代码的功能模块和数据扩散情况。通过实验对其可行性和高效性进行了验证。

Differential analysis on dynamic binary and its application in malicious code analysis

Static binary analysis methods cannot meet the demand for malicious code analysis, and the traditional dynamic analysis approaches cannot effectively find the critical information among the huge amount of dynamic binary code. This paper gave a kind of differential analysis approach on dynamic binary code and provided its model and method. This approach could effectively extract the sensitive information from malicious code and make the function module or data spread understood. Finally, it provided an experiment based on differential binary analysis system, which validated the capability and efficiency of the approach.