An anti-interference method and device for evaluating behavior similarity of environment-sensitive malware

Abstract

The invention relates to an anti-interference method and device for evaluating behavior similarity of environment-sensitive malicious software. The method comprises the following steps: 1) placing suspicious software in multiple different execution environments, and recording the behavior sequence of the suspicious software; 2) normalizing the behavior sequence of the suspicious software; 3) removing the behavior sequence of the suspicious software Interference processing; 4) Calculating and comparing the similarity of the behavior sequence after the interference removal processing; 5) Based on the similarity of the behavior sequence, judging whether the suspicious software is environment-sensitive malware. The present invention can effectively eliminate a large number of interference behaviors of malicious software, accurately calculate the similarity of behavior sequences, and make the detection of this type of malicious software more accurate; meanwhile, the method can standardize the processing of malicious software behavior sequences, eliminating the differences between different systems Semantic deviation, with good usability and universality, reduces the detection cost.

Description

technical field [0001] The invention belongs to the technical field of system security, and relates to an environment-sensitive malicious software behavior similarity evaluation method, in particular to an anti-interference environment-sensitive malicious software behavior similarity evaluation method and device. Background technique [0002] With the rapid development of network information technology, malicious software has become one of the main threats to network public security. According to Rising 2013 Information Security Report (Rising. 2013 China Information Security Report [EB / OL] [2014-03-12]) pointed out that in 2013, a total of 1.145 billion people in China were infected by malware, and 23 million computers were attacked. From January to December 2013, more than 33.1 million new malware samples were added, and the total number increased by 163% compared with the same period in 2012. With the explosive growth of the number of malware, traditional malware analysi...

AI Technical Summary

Problems solved by technology

3) Browser hijacking: Refers to the behavior of modifying the user's browser or other related settings without the user's permission, forcing the user to visit a specific website or causing the user to be unable to access the Internet normally

[0006] In recent years, many detection methods have appeared in the research of environment-sensitive malware, but the current detection methods mainly have the following problems: 1) The adversarial detection mechanism is insufficient, and it is impossible to determine whether the environment-sensitive malware has released malicious behaviors, affecting Detection results; 2) If the environment-sensitive malware has a large number of random behaviors, the detection effect of the existing methods is not ideal, and the authors of such malware usually add a large number of random behaviors before the malware releases malicious behaviors, which will greatly interference detection and judgment, and the existing detection methods cannot effectively deal with

Images