基于行为特征分析的恶意代码检测系统研究与实现

发布时间：2018-07-15 13:57

【摘要】：目前病毒、木马、后门程序等恶意代码技术飞速发展,重大经济损失事件及重要泄密事件频频发生。传统的检测技术针对未知恶意代码的检测效果较差,因此针对二进制代码的行为深入分析,挖掘正常软件与恶意软件行为特征的细微区别正是目前网络安全的迫切需要。本文通过对目前互联网中出现的著名恶意代码(如:鬼影、机器狗、Darkshell等)进行深入调试分析及对比研究,发现恶意代码的行为特征;然后通过分析应用程序IAT结构、API Hook技术、差异性检测方法、通知例程检测方法等多种技术手段,研究针对恶意代码的自动分析方法,并选定API调用序列作为行为特征主要研究依据;在针对恶意代码进行分析的过程中往往会遇到Rootkit病毒,使得分析无法进行,因此分析了Rootkit木马的实现原理及检测手段,并针对IAT钩子、EAT钩子、IDT钩子及SSDT钩子进行重点论述;最后本文针对原始攻击树模型、改进攻击树模型、扩展攻击树模型等进行了分析比较,提出了基于赋权特征向量的改进攻击树模型,在此模型中利用赋权特征向量的概念将恶意行为进行分类。基于赋权特征向量的改进攻击树模型,设计并实现一种主动检测系统原型。该原型对恶意代码的行为特征进行数学建模,综合恶意代码的API调用序列,功能性行为特征、隐藏性行为特征、Rootkit行为特征等作为判别依据,并给出详细的分析报告及关键行为记录,方便对恶意代码的手动查杀及深入分析。实验表明,本方法能够有效地检测已知或未知的恶意代码,针对利用花指令、加壳、多态变形等反检测技术的恶意代码也能进行有效的检测,在恶意软件的主动识别方面有较大的应用价值。
[Abstract]:At present, malicious code technology, such as viruses, Trojans, backdoors and so on, has developed rapidly, and major economic losses and important leaks have occurred frequently. The traditional detection technology is poor for the detection of unknown malicious code, so it is an urgent need to analyze the behavior of binary code and mine the subtle difference between normal software and malware behavior. This paper analyzes and compares the famous malicious code (such as ghost, Duck shell and so on) in the Internet, finds out the behavior characteristics of malicious code, and then analyzes the API Hook technology of the application IAT structure. This paper studies the automatic analysis method for malicious code, and selects API call sequence as the main research basis for behavior characteristics. In the process of analyzing malicious code, rootkit virus is often encountered, which makes the analysis impossible. Therefore, the realization principle and detection method of rootkit Trojan horse are analyzed, and the IDT hook and SSDT hook of IAT hook are discussed emphatically. Finally, this paper analyzes and compares the original attack tree model, improved attack tree model and extended attack tree model, and proposes an improved attack tree model based on weighted eigenvector. In this model, the concept of weighted eigenvector is used to classify malicious acts. An active detection system prototype is designed and implemented based on an improved attack tree model based on weighted eigenvector. The prototype models the behavior characteristics of malicious code, synthesizes API call sequence, functional behavior feature, hidden behavior feature and rootkit behavior feature of malicious code. Detailed analysis report and key behavior record are given to facilitate manual detection and in-depth analysis of malicious code. Experiments show that this method can effectively detect known or unknown malicious code, and can also detect the malicious code using flower instruction, shell, polymorphic deformation and other anti-detection techniques. It has great application value in active recognition of malware.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】