基于Win32 API调用监控的恶意代码检测技术研究

论文首先分析了现有动态检测恶意代码技术的不足，指出其受恶意代码的旁路攻击和拟态攻击的可能。然后，提出了防范此类攻击的API陷阱技术和调用地址混淆技术。最后由此实现了一个基于Win32API调用监控的恶意代码检测系统，经实验证明，该系统能检测出已知和未知的恶意代码的攻击。

Research OB Malicious Cede Detection Technology Based on Monitoring Win32 API Calls

This paper analyzes first the existing dynamic malicious code detection technology and its deficiencies, and points out the probability that those technologies may be affected by mimetic attack and bypass attack of the malicious code. Then, it proposes an API trap technology and call address confusion technology for preventing the bypass attack and mimetic attack, thus achieving a malicious code detection system based on Win32 API calls monitoring technology. The experiment indicates that the system could detect the known and unknown malicious code.