Malicious software homology analysis method based on behavior tree

Abstract

The invention discloses a malicious software homology analysis method based on a behavior tree, provides a new definition for behaviors of malicious software, is not limited to analysis of API continuous short sequences, describes behavior characteristics of the malicious software from each behavior and a relationship between the behaviors, and is richer in behavior semantics. The method comprisesthe following steps: firstly, calling a sequence from an API generated during malicious software execution, and constructing the behavior tree for reflecting a malicious software behavior model by adopting an Inductive Miner algorithm; secondly, extracting behavior characteristics from each behavior tree, generating family weighted behavior characteristics, converting the behavior trees into similarity vectors based on a similarity algorithm, and finally, training a family classification model by applying a naive Bayes classification algorithm. According to the method, the problems of lack ofa control structure and existence of noise in the API sequence in previous malicious software homology analysis based on the API sequence can be solved, and the malicious software family classification capability is improved.

Description

technical field [0001] The invention relates to the technical field of computer security research, in particular to a behavior tree-based malware homology analysis method. Background technique [0002] Most of the newly emerging malware are variants of known malware families. Therefore, finding the homology between unknown malware and known malware families and quickly classifying unknown malware is helpful. to speed up malware analysis. [0003] Malware belonging to the same family has similar behaviors, and the API call sequence is the information source that best describes the behavior of malware. Therefore, most studies use the API call sequence as the research basis, but the API sequence is used as the research basis for malware analysis. object, faced with the following problems: [0004] First, in order to improve the anti-detection ability of malware, malware authors randomly insert redundant APIs in the process of writing malware without affecting the original beh...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the present invention is to solve the problem that the common malware analysis method based on the API sequence ignores the control structure between the APIs in the prior art, resulting in the wrong classification of the malware, and solves the problem that the API sequence of the malware has a noisy API, which destroys the original Distinguishable features affect the performance of malware analysis, provide a behavior tree-based malware homology analysis method, and improve the accuracy of malware homology judgments

Images