CAJ | 학술논문

针对恶意代码数量呈爆发式增长，但真正的新型恶意代码却不多，多数是已有代码变种的情况，通过研究恶意代码的行为特征，提出了一套判别恶意代码同源性的方法。从恶意代码的行为特征入手，通过敏感恶意危险行为以及产生危险行为的代码流程、函数调用，应用反汇编工具提取具体特征，计算不同恶意代码之间的相似性度量，进行同源性分析比对，利用DBSCAN聚类算法将具有相同或相似特征的恶意代码汇聚成不同的恶意代码家族。设计并实现了原型系统，实验结果表明提出的方法能够有效地对不同恶意代码及其变种进行同源性分析及判定。
침대악의대마수량정폭발식증장，단진정적신형악의대마각불다，다수시이유대마변충적정황，통과연구악의대마적행위특정，제출료일투판별악의대마동원성적방법。종악의대마적행위특정입수，통과민감악의위험행위이급산생위험행위적대마류정、함수조용，응용반회편공구제취구체특정，계산불동악의대마지간적상사성도량，진행동원성분석비대，이용DBSCAN취류산법장구유상동혹상사특정적악의대마회취성불동적악의대마가족。설계병실현료원형계통，실험결과표명제출적방법능구유효지대불동악의대마급기변충진행동원성분석급판정。
With the problem of the explosive growth of malicious code and many of the malicious samples are variations of previously encountered samples, this paper presents a novel approach to investigate the homology of malicious code based on behavior characteristics. To distinguish the variations of malicious code, it studies the malicious behavior of malwares, then computes the similarity of characteristics and the call graphs which are extracted by disassembly tools. It employs the clustering algorithms of DBSCAN to discover the family of malicious code. Experiments show that it effectively investi-gates the homology of malicious code and cluster variations into different malicious code family.