CAJ | 학술논문

随着恶意程序的快速增多，常用的分析技术遇到了瓶颈。文中总结与分析了国内外现有主流的恶意程序检测方法，运用了底层的多种HOOK技术，在底层驱动中利用重定向技术从文件、注册表、网络、进程、线程、窗口消息等多个方面，设计与构造了改进的混合型沙盒和行为分析器。沙盒可保证程序在运行中不会破坏真实的系统，可提高分析效率，可连续分析，不需要还原环境。行为分析器通过记录程序的函数调用序列，使用风险等级来判断程序的风险程度，运用了独创的行为分析算法来计算程序的风险级别，通过自定义的规则自动判断程序的恶意程度，同时生成分析报告，达到自动化分析的目的。经过测试，说明该系统达到了预期功能，能有效地保护真实系统，同时也能准确获取到恶意程序的行为，其分析结果是有效的。
수착악의정서적쾌속증다，상용적분석기술우도료병경。문중총결여분석료국내외현유주류적악의정서검측방법，운용료저층적다충HOOK기술，재저층구동중이용중정향기술종문건、주책표、망락、진정、선정、창구소식등다개방면，설계여구조료개진적혼합형사합화행위분석기。사합가보증정서재운행중불회파배진실적계통，가제고분석효솔，가련속분석，불수요환원배경。행위분석기통과기록정서적함수조용서렬，사용풍험등급래판단정서적풍험정도，운용료독창적행위분석산법래계산정서적풍험급별，통과자정의적규칙자동판단정서적악의정도，동시생성분석보고，체도자동화분석적목적。경과측시，설명해계통체도료예기공능，능유효지보호진실계통，동시야능준학획취도악의정서적행위，기분석결과시유효적。
With the rapid increase of malicious programs,common analysis technology has encountered bottleneck. In this paper,summa-rize and analyze the domestic and foreign existing mainstream malware detection method,using the underlying multiple HOOK technolo-gy,utilizing the redirection technology in the underlying driver from a file,registry,network,process,thread,window message and so on, design and construct an improved sandbox analyzer and behavior. Sandbox ensures application won’ t destroy the real system in opera-tion,which can improve the efficiency of analysis,can be used to analyze continuously,do not need to restore the environment. Behavior analyzer by recording the program sequence of function calls,using risk level to judge the risk degree of the program,using the original behavior analysis algorithm to calculate the risk level of the program,through the custom rules automatically judge the malicious degree of the program,at the same time generate analysis report,to achieve the purpose of automatic analysis. After testing,the system runs stable and extensible,the analysis result is valid.