Automatic malicious code behavior analysis system

Abstract

The invention relates to an automatic analysis system for malicious code behaviors. The system comprises a full-system simulator, a symbol execution module, a path analysis module, a path selection module, a malicious behavior analysis module, a control flow analysis module and an effective input set analysis module, wherein the symbol execution module finds a branch dependent on a symbol variablein a binary malicious code and then generates path judgment predicate logic. The path analysis module analyzes the path judgment predicate logic, generates a new execution path and adds the new execution path into the path storage pool; the path selection module carries out priority setting on paths in the path storage pool; the control flow analysis module generates and continuously updates a control flow graph CFG; the malicious behavior analysis module extracts malicious behavior characteristics and structural characteristics realized by the associated code segment; the effective input setanalysis module finds out an input value set which enables the malicious behavior program to execute according to a specific path. The invention provides an efficient malicious code behavior automatic analysis system.

Description

technical field [0001] The invention relates to a malicious code behavior analysis system, in particular to an automatic malicious code behavior analysis system. Background technique [0002] Malicious code is one of the important factors threatening computer system and network security. Malicious code is a general term for software with malicious behavior that infiltrates or destroys computer systems without the knowledge of users. , Rootkits, spyware, etc. Malicious code analysis is used to extract the characteristic information of malicious code, which is the basis and premise of malicious code detection and discovery. In recent years, due to the rapid development of malicious code, it is very necessary to automatically analyze binary malicious code. The analysis results are not only very important in the design of defense systems. Useful, and also helps to understand the attacker's attack capabilities. [0003] Currently, one of the methods of malicious code analysis ...

AI Technical Summary

Problems solved by technology

However, setting up different environments and testing the program in this environment is expensive and inefficient, and the possibility of guessing the correct environment that satisfies the conditions is very small

Therefore, this method cannot be fully effective in analyzing binary malicious code

Images