Malicious program behavior feature library construction method and device

Abstract

The invention relates to the field of computer security, and particularly relates to a malicious program behavior feature library construction method and device. Aiming at the problems in the prior art, the invention provides a malicious program behavior feature library construction method and device. According to the malicious program behavior feature library construction method and device provided by the invention, behaviors are automatically extracted by a machine, and according to a malicious value sequence of the behaviors, a malicious program behavior feature library is automatically constructed, so that behavior extraction efficiency of a malicious program can be greatly improved, and a manual participation degree is reduced. According to the malicious program behavior feature library construction method and device provided by the invention, behavior operations of n sample files in a sample file set are acquired; then the behavior operations of all the sample files are subjected to merging of similar behavior operations; a malicious value of each behavior, i.e. the malicious value is equal to tf*ldf*vf, is calculated, wherein tf represents a occurrence frequency of each behavior, ldf represents a reverse sample frequency of each behavior, and vf represents a malicious frequency number of the calculated behaviors; sorting is carried out according to the malicious values of the behaviors; malicious behavior features are determined; and the malicious program behavior feature library is constructed.

Description

technical field [0001] The invention relates to the field of computer security, in particular to a method and device for constructing a malicious program behavior feature library. Background technique [0002] With the widespread use of personal computers and mobile phones, information security has increasingly become an important research direction in modern society. The detection method of malicious programs has also developed from the simple detection of static characteristic values ​​to the detection of dynamic behaviors of malicious programs. Malicious program dynamic detection mainly extracts the behavior of the program and compares it with the known malicious behavior signature database. At present, the construction of malicious behavior signature database mainly relies on manual analysis of malicious programs, mainly using feature string or feature keyword matching technology, by extracting key feature words to form a feature font library, and scanning the detected ...

AI Technical Summary

Problems solved by technology

This method runs fast and has low false alarm frequency, but it needs to continuously update and expand the feature words

At the same time, new malicious programs cannot be detected, and old malicious program variants can also avoid matching-based detection by adjusting instruction sequences and other methods.

As the mutation ability of malicious programs is increasing day by day, the generation of new malicious programs is accelerating, and the method of constructing the behavioral feature library of malicious programs by manual analysis is very inefficient.

Images