摘要
恶意代码行为分析主要包括汇编级行为分析和系统调用级行为分析,其中汇编级行为分析以其较细的分析粒度成为了刻画代码行为的一种不可替代的重要方式.但是,现有的恶意代码汇编级分析对于不连续的指令模式分析效果不佳.针对这种情况,结合二进制代码特点,提出了一种基于限长空位字符串匹配算法的二进制恶意代码汇编级行为分析方法 CFG-refinedSAIL.该方法首先通过行进递归反汇编算法重建代码结构,然后将按控制流基本块组织的操作码序列同表示恶意行为的操作码序列进行逐步求精的比对,确定恶意代码汇编级行为的存在.最后,通过实验验证了该方法在分析恶意代码汇编级行为过程中的有效性,同时该方法也具有良好的执行效率,这些都为恶意代码的后续分析奠定了良好的基础.
The malware behavior analysis is composed of analysis in disassembly level and system-call level. Out of the finer grain, the analysis in disassembly level is irreplaceable in characterizing the code behavior. However,the existing analysis technologies in disas- sembly level is not good at coping with discontinuous instruction sequences. In view of this situation and characteristics of binary code, this paper proposes a method of behavior analysis in disassembly level based on pattern matching with wildcards and gap-length constrains,called CFG-refinedSAIL. It reconstructs the code structtlre by the recursive traversal disassembly algorithm first. Then the algorithm compares the opcode sequences in each basicblock of control flow with the opcode sequences of malware behavior in a re- fined way to find out the malware behavior in disassembly level. Finally ,the test validates the effectiveness the algorithm,and its per- forrnance is good, which could provide the basis for subsequent analysis of malware.
出处
《小型微型计算机系统》
CSCD
北大核心
2017年第1期118-123,共6页
Journal of Chinese Computer Systems
基金
国家自然科学基金面上项目(61472447)资助
关键词
恶意代码
行为分析
模式匹配
操作码
malware
behavior analysis
pattern matching
operation code
