Structural characteristics-based malicious code heuristic detection method and system

Abstract

The invention provides a structural characteristics-based malicious code heuristic detection method, which comprises the steps of obtaining and analyzing a to-be-detected sample; if the to-be-detected sample is an executable file of a specific structure, further judging whether the to-be-detected sample comprises a suspicious string structure or not; if so, matching the to-be-detected sample with a known malicious sample library, if the to-be-detected sample is matched with the known malicious sample library, judging the to-be-detected sample as a malicious sample; if not, locating the suspicious string structure; judging whether the suspicious string structure comprises a suspicious string or not, and if so, judging the to-be-detected sample as the malicious sample and adding the suspicious string to the known malicious sample library. According to the structural characteristics-based malicious code heuristic detection method, the problem of a limitation that an import table can only be detected through detecting a malicious code in a traditional detection method is solved; and meanwhile, the detection rate and the accuracy of a non-traditional format PE file can be effectively improved and the detection speed is improved.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a heuristic detection method and system for malicious codes based on structural characteristics. Background technique [0002] The structure of executable files is not static, such as from early LE, NE, to today's PE, and MSIL files improved on the basis of PE. The change of the executable file structure means that the existing detection technology for executable files may be less effective or even invalid when encountering the new file structure. [0003] Take MSIL (Microsoft Intermediate Language) as an example. It is an intermediate process of converting .Net code into machine language. It is a pseudo-assembly language between high-level language and Intel-based assembly language. When the compiler compiles the .Net code, in addition to generating MSIL code, it also generates metadata. Metadata is used to describe types in code, including the definition of each ...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the above problems, the present invention provides a malicious code heuristic detection method based on structural characteristics. By identifying the structural characteristics of different specific structural files, the detection position of the sample to be detected can be quickly located, and the traditional detection method can only be solved by Detect malicious code, detect import table and other limitations, and can effectively improve the detection rate and accuracy of PE files in non-traditional formats, and improve the detection speed

Images