基于多API序列挖掘控制流图的恶意软件分析
密码学与安全
2017-07-11 v1
摘要
恶意软件通过生成同族或异族的完整变体而变得持久。同族恶意软件在感染受害计算机的功能上共享相同特征。恶意软件家族间的这些相似特征可作为构建一种解决方案的度量，该方案有助于检测属于特定家族的恶意软件。在我们的方法中，我们利用以 API 序列的 n-gram 形式记录这些特征来检测这些恶意软件家族。我们使用多种相似性评分方法，并提取多个 API 序列以有效分析恶意软件。
引用
@article{arxiv.1707.02691,
title = {Malware Analysis using Multiple API Sequence Mining Control Flow Graph},
author = {Anishka Singh and Rohit Arora and Himanshu Pareek},
journal= {arXiv preprint arXiv:1707.02691},
year = {2017}
}
备注
We really appreciate your work. This one is smart, short, efficient and well explained. This is a quality work that deserves to be published. Just few questions, which are more about curiosity than something else... First, when you disassemble opcodes and draw the CFG, how you treat instructions such as: call rax, jmp rbx, movcc, jcc rcx