一种基于综合行为特征的恶意代码识别方法

基于行为的分析方法是恶意代码检测技术的发展方向,但现有的以孤立行为特征为依据的恶意代码识别方法误报率较高,本文提出了一种基于代码综合行为特征的恶意代码检测方法-IBC-DA.该算法通过改造的攻击树模型描述恶意代码执行过程中各相关主体间的关系,在此基础上计算得到的恶意性权值能够更加准确地反映代码执行过程对系统的影响.实验表明,利用本文算法进行病毒检测具有较低漏报率和误报率,并对未知恶意代码的防范具有积极意义.

A Malicious Code Detection Method Based on Integrated Behavior Characterization

The existing malicious code detection algorithms which are based on individual behaviors have some drawbacks.In this paper we present a new malicious code detection algorithm based on behavior characteristics by importing improved attack tree model to describe the entity relationships during the malicious code execution time.It is named IBC-DA.The experiments result shows that the proposed algorithm works in most cases of detection and only has minor errors in few conditions.This algorithm has very positive...