Method and system for determining malicious code based on calling relation

Abstract

The invention discloses a method and a system for determining malicious codes based on calling relations. The method comprises: decompiling a to-be-detected program and obtaining pseudocode; analyzingthe pseudocode and establishing a calling structure tree; traversing the calling structure tree, to obtaining behavior data of the to-be-detected program, when the obtained behavior data is matched with predefined malicious behavior data, determining that the to-be-detected program has malicious codes, wherein the malicious behavior data includes malicious behavior, and calling relations or calling positions of malicious behaviors. In the technical scheme, through converting the calling relations of programs to hierarchical relations of the calling structure tree, more detailed program information is provided to a machine, and finally accuracy of malicious code determination is improved.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and system for judging malicious codes based on calling relationships. Background technique [0002] As society moves towards the Internet era, the rapid development of the Internet has also improved people's lives, but it has also attracted many malicious application developers who attempt to make illegal profits from it. The number of malicious applications is growing at an unprecedented rate, and various new viruses and variant viruses are updated more and more frequently. These problems can no longer be solved by human judgment alone. How to use machines to identify viruses in a smarter and more accurate way has become the key to solving the problem. [0003] At present, the static detection technology for malicious code is mainly through decompilation, and malicious determination is made on the decompiled pseudo-code data. That is, the sensitive funct...

AI Technical Summary

Problems solved by technology

This detection efficiency is low, which not only increases the cost of malicious sample detection, but also misses the best time to intercept viruses, which may poison more common user devices (mobile phones, computers, etc.)

Images