CAJ | 학술논문

软件的中间代码是位于机器语言和高级程序语言之间程序语言，具有容易理解的语义信息和控制结构信息，能真实地反映软件在执行过程中的实际情况。利用中间代码的语义信息来研究恶意软件，可以发现恶意软件的具体行为信息或特点；通过多种方式对比中间代码形成的控制流图整体或局部信息，实现恶意软件的检测。机器学习为软件安全性信息或规则挖掘提供便利，成为一种先进的恶意软件检测方法。本文从中间代码的语义信息和控制结构两方面对多种恶意软件检测技术进行归类与比较，同时对基于机器学习的中间代码处理与应用方法进行了深入分析和探讨。
연건적중간대마시위우궤기어언화고급정서어언지간정서어언，구유용역리해적어의신식화공제결구신식，능진실지반영연건재집행과정중적실제정황。이용중간대마적어의신식래연구악의연건，가이발현악의연건적구체행위신식혹특점；통과다충방식대비중간대마형성적공제류도정체혹국부신식，실현악의연건적검측。궤기학습위연건안전성신식혹규칙알굴제공편리，성위일충선진적악의연건검측방법。본문종중간대마적어의신식화공제결구량방면대다충악의연건검측기술진행귀류여비교，동시대기우궤기학습적중간대마처리여응용방법진행료심입분석화탐토。
The intermediate code is a special style of software representation which locates between the machine language and the high level programming language ,and it can take advantage of understandable semantic information and actual execution condition for malware analysis .The malicious behavior infor-mation and characteristics can be easily found from the semantic information of intermediate code ,and malware detection or classification can be realized by analyzing the whole or local information of control flow graph .Machine learning facilitates security information and rules mining in a large number of com-plex software representations ,which is deemed as a kind of advanced malware detection method in recent malware research .This paper categorizes and analyzes the malware research technologies according to the semantic information and control flow structure of software intermediate code ,and makes deep anal-ysis to intermediate code processing and application methods based on machine learning .