Automatic malicious code variation detection method

Abstract

The invention discloses an automatic malicious code variation detection method. The method comprises the following steps of: feeding a to-be-detected program into a program quality detection system, so as to detect whether the to-be-detected program is a strictly executable program or not: verifying simple features such as a size, a suffix and a naming rule of the program; storing the to-be-detected program which passes the program quality detection system in a database, and handing over the to-be-detected program to a malicious code variation detection system to carry out detection; and if the quantity of newly detected malicious codes stored in a database system achieves a preset threshold value, triggering a set trigger in the database system, so as to enable an automatic fine tuning system to start work. According to the method, a software component technology is flexibly applied to design and development of systems, so that the reliability and extensibility and maintainability ofthe systems are improved, the malicious code variation detection system perfect in function is realized, and the current manner of manually selecting malicious code to detect features is improved.

Description

technical field [0001] The invention belongs to the field of information security, in particular to a malicious code variant detection method, which belongs to the malicious code protection technology. Background technique [0002] In recent years, the number of malicious programs on the Internet has continued to maintain a rapid growth trend. Classified according to their malicious behavior, the top three are rogue behavior, malicious deduction and tariff consumption. Although under the guidance of the Ministry of Industry and Information Technology, the distribution of malicious programs is strictly controlled, the number of malicious programs distributed through informal platforms continues to grow. At the same time, the number of malicious code variants has increased sharply, and malicious code authors spend more time making minor changes or packaging for further propagation and evasion of detection. Different practical and effective solutions need to be provided for di...

AI Technical Summary

Problems solved by technology

However, malicious code writers have applied various obfuscation methods or intrusion methods in order to evade detection rules, so that malicious code detection programs need to constantly update the static or dynamic features that need to be detected.

This will seriously increase the time consumption of malicious code detection, and the malicious code may successfully evade detection due to failure to update the signature database on time

Images