摘要： 完整准确地提取函数调用图是基于函数调用图进行恶意程序相似性分析的基础。为此,提出一种动静结合的恶意程序函数调用图提取方法。在对程序进行静态反汇编的基础上抽取恶意程序的可执行路径,使用隐藏信息主动发现策略找出恶意程序中隐藏的指令和函数调用,采用动态反馈机制完成动静结合分析过程中的信息同步。实验结果表明,该方法能够有效应对各种恶意程序反分析技术,完整准确地提取出恶意程序的函数调用图。

关键词: 恶意程序, 函数调用图, 控制流图, 静态分析, 动态分析

Abstract: Extracting a complete and accurate function call graph is the foundation of malware similarity analysis based on function call graph.This paper proposes a malware function call graph extraction method which integrates both dynamic and static analysis methods.It extracts executable path of malicious programs on the basis of static disassembly,and an active discovery strategy of hidden information is used to find out the hidden instructions and function calls in the malware.A dynamic feedback mechanism is used to ensure the information synchronization during the process of static and dynamic analysis.The experimental results show that the proposed method can deal with all kinds of reverse analysis technologies and extract a complete and accurate function call graph from malwares.

Key words: malware, function call graph, control flow graph, static analysis, dynamic analysis

中图分类号: 

• TP309