摘要
抽象解释理论是Cousot.P和Cousot.R于1977年提出的程序静态分析时构造和逼近程序不动点语义的理论。文章将该理论应用于恶意程序特征码抽取,通过详细描述抽取过程的各个步骤,提出了一种专门针对多态恶意程序的检测方法,从而为恶意程序检测开辟了新的思路。实践证明所述方法准确、高效。
interpretation theory was proposed by P. Cousot and R. Cousot in 1977, and it is widely used in the program’s static analysis domain to construct and approximate the program’s fixpoint semantics. This paper puts forward a detection method for polymorphic malware by applying the theory into the extraction of signatures, describes each step in the abstraction process in detail, and opens up a novel thought for malware detection. The method is proved to be accurate and efficient in real work.
出处
《信息网络安全》
2013年第1期16-18,共3页
Netinfo Security
关键词
抽象解释
多态恶意程序
特征码
变形器
解码器
程序逻辑
Abstract Interpretation
Polymorphic Malware
Signature
Mutation Engine
Decryptor
Program Logic
