摘要
传统的基于特征的恶意代码检测方法无法检测未知恶意代码以及一些采用加壳等规避技术的恶意代码。为克服这些缺点,文章提出了基于专家系统的启发式检测方法。该方法可以检测采用了底层技术的恶意代码,如rootkit,以及加过壳或加过密的恶意代码,而且其检测率比一些知名的反病毒工具的检测率要高。
Traditional signature-based malware detection method is not able to detect zero-day attacks and some malwares adopting circumvention techniques such as packer. In order to overcome this drawback, this paper proposes a heuristic detection technique based on expert systems. The technique could detect malwares using known techniques, even bottomlevel techniques, for example, the rootkit technique. It also can detect those malwares even after they are packed or crypto-protected by any packer or protector. And its detection rate is much higher than some well-known anti-virus tools.
出处
《信息安全与通信保密》
2009年第9期77-79,82,共4页
Information Security and Communications Privacy
基金
"863"计划(2006AA01Z449)资助
关键词
启发式技术
专家系统
行为检测
heuristic technique
expert system
behavior detection
