计算机工程与应用2017，Vol.53Issue(14)：93-98,6.DOI:10.3778/j.issn.1002-8331.1609-0202
基于静态结构的恶意代码同源性分析
Homology analysis of malware based on function structure
摘要
Abstract
With the emergence of metamorphic and polymorphic technology, the account of malicious code is in explo-sive growth, most of which is the variant of previously encountered samples. In order to conquer this problem and focus on new types of virus, this paper presents an approach to determine the family of malicious code. It extracts the static fea-ture of malware samples by using disassembly tools, and filters out characteristic functions through one-class support vec-tor machine. A family feature database is generated from those functions by adopting clustering idea. Unknown samples, after extracting characteristic functions, are compared to the content of database to determine their family. Experimental results show that it can effectively investigate the malicious code and classify variations into different malware family.关键词
恶意代码/单类支持向量机/静态分析/聚类Key words
malicious code/one-class Support Vector Machine(SVM)/static analysis/clustering分类
信息技术与安全科学引用本文复制引用
陈琪,蒋国平,夏玲玲..基于静态结构的恶意代码同源性分析[J].计算机工程与应用,2017,53(14):93-98,6.基金项目
国家自然科学基金(No.61374180,No.61373136,No.61672298). （No.61374180,No.61373136,No.61672298）
