Anti-interference environmental sensitive type malicious software behavior similarity evaluation method and device

Abstract

The invention relates to an anti-interference environmental sensitive type malicious software behavior similarity evaluation method and device. The method comprises the following steps that: 1) putting suspicious software in various different execution environments to record the behavior sequence of the suspicious software; 2) carrying out normalized processing on the behavior sequence of the suspicious software; 3) carrying out interference removal processing on the behavior sequence of the suspicious software; 4) calculating and comparing the similarity of behavior sequences subjected to theinterference removal processing; and 5) on the basis of the similarity of behavior sequences, judging whether the suspicious software is the environmental sensitive type malicious software or not. Byuse of the method, a great quantity of interference behaviors of the malicious software can be effectively eliminated, the similarity of behavior sequences can be accurately calculated, and therefore, the type of malicious software can be accurately detected. Meanwhile, the method can carry out normalized processing on the malicious software behavior sequence, a semantic bias among different systems is eliminated, the method exhibits good availability and universality, and detection cost is lowered.

Description

technical field [0001] The invention belongs to the technical field of system security, and relates to an environment-sensitive malicious software behavior similarity evaluation method, in particular to an anti-interference environment-sensitive malicious software behavior similarity evaluation method and device. Background technique [0002] With the rapid development of network information technology, malicious software has become one of the main threats to network public security. According to Rising 2013 Information Security Report (Rising. 2013 China Information Security Report [EB / OL] [2014-03-12]) pointed out that in 2013, a total of 1.145 billion people in China were infected by malware, and 23 million computers were attacked. From January to December 2013, more than 33.1 million new malware samples were added, and the total number increased by 163% compared with the same period in 2012. With the explosive growth of the number of malware, traditional malware analysi...

AI Technical Summary

Problems solved by technology

3) Browser hijacking: Refers to the behavior of modifying the user's browser or other related settings without the user's permission, forcing the user to visit a specific website or causing the user to be unable to access the Internet normally

[0006] In recent years, many detection methods have appeared in the research of environment-sensitive malware, but the current detection methods mainly have the following problems: 1) The adversarial detection mechanism is insufficient, and it is impossible to determine whether the environment-sensitive malware has released malicious behaviors, affecting Detection results; 2) If the environment-sensitive malware has a large number of random behaviors, the detection effect of the existing methods is not ideal, and the authors of such malware usually add a large number of random behaviors before the malware releases malicious behaviors, which will greatly interference detection and judgment, and the existing detection methods cannot effectively deal with

Images