计算机工程 ›› 2013, Vol. 39 ›› Issue (1): 80-84.doi: 10.3969/j.issn.1000-3428.2013.01.017

• 软件技术与数据库 • 上一篇    下一篇

基于API依赖关系的代码相似度分析

姚新磊,庞建民,岳 峰,余 勇   

  1. (信息工程大学信息工程学院,郑州 450002)
  • 收稿日期:2012-04-06 修回日期:2012-05-07 出版日期:2013-01-15 发布日期:2013-01-13
  • 作者简介:姚新磊(1986-),男,硕士研究生,主研方向:软件逆向工程,信息安全;庞建民,教授、博士、博士生导师;岳 峰,博士研究生;余 勇,硕士研究生
  • 基金项目:
    国家“863”计划基金资助重点项目(2009AA012201);河南省重大科技攻关计划基金资助项目(092101210501)

Code Similarity Analysis Based on API Dependence Relation

YAO Xin-lei, PANG Jian-min, YUE Feng, YU Yong   

  1. (Institute of Information Engineering, Information Engineering University, Zhengzhou 450002, China)
  • Received:2012-04-06 Revised:2012-05-07 Online:2013-01-15 Published:2013-01-13

摘要: 针对传统系统调用依赖图(SCDG)不能很好地消除API噪声、API重排等API特征混淆的问题,提出一种基于API依赖关系的恶意代码相似度分析方法。采用由API控制依赖关系和4类数据依赖关系组成的SCDG程序行为描述方式,通过数据依赖关系分析和控制依赖关系归一化,消除SCDG中的API噪声和API重排。实验结果表明,与API序列相似度分析方式相比,该方法能提高恶意代码相似度分析的准确性。

关键词: 恶意代码, 相似度分析, 数据依赖, 控制依赖, 系统调用依赖图, Jaccard系数

Abstract: Aiming at the problem of API feature obfuscation caused by API noise and API rearrangement which traditional System Call Dependence Graph(SCDG) can not eliminate, this paper presents a malicious code similarity analysis method based on API dependence. The method uses a program behavior description based on SCDG composed of control dependence and four types of data dependence between APIs. API noise and API rearrangement are eliminated through data dependence analysis and control dependence normalization. Experimental results show that, compared with API sequence similarity analysis method, this method significantly improves the accuracy of the similarity analysis of malicious code.

Key words: malicious code, similarity analysis, data dependence, control dependence, System Call Dependence Graph(SCDG), Jaccard index

中图分类号: