A Study on a Framework of Detection of Malicious Behavior Patterns

我们研究了一个程序框架，该程序可以从执行一些非用户意图的恶意行为的程序中检测恶意行为模式。该框架是基于一种包含未知病毒的判断程序是否为计算机病毒的方法构建的。计算机病毒是一种典型的恶意行为程序。此外，我们开发了一个程序，收集目标程序的行为数据。2003年，未知病毒检测程序从面向对象开发和元建模两个角度对模型进行了重新设计。首先，利用面向对象开发中的统一建模语言UML对行为模式规范的图形化模型和检测程序进行了程序结构分析；检测程序由以下三部分组成。(1)程序执行环境的抽象模型。(2)病毒行为模式的定义。(3)使用特征码检测更多病毒的定义。该程序（用标准ML编写）是基于一阶谓词逻辑使用扩展ML描述的规范来定义的，规范、部分(2)和部分(3)是行为模式检测程序框架的定位点。(2)部分是框架的一个热点，它可能会根据我们想要检测的一些行为模式而改变。在2004年，我们将程序的规范定义为一些模块，并检查了面向方面编程技术对我们框架的有效性。然而，与仅按阶级定义课程相比，没有发现很大的优点。2005年，我们研究并实现了一种跟踪数据移动的方法，以检测通过邮件系统进入的计算机病毒。我们进行了一些实验来检测病毒。这种恶意程序有一些设备，使其难以分析。我们还定义了一种使设备失效的方法。我们正计划验证这一框架的有效性。少

We studied a framework of the program that detects malicious behavioral patterns from the program that performs some malicious behavior which was not intended by the user. This framework was built based on a method which judges whether a program was a computer virus including unknown viruses. Computer virus is a typical malicious behavioral program. Moreover, we developed a program that collects behavioral data of the target program. In 2003, the unknown virus detection program was redesigned the model from both viewpoints of object-oriented development and meta-modeling. First, the program structure was analyzed based on the graphical model of the specification of behavioral patterns and the detection program by UML which is a unified modeling language in object-oriented development. The detection program consists of the following three parts. (1)An abstract model of the program execution environment. (2)The definition of behavioral patterns of virus. (3)The definition of detection of … More virus using the patterns. The program (written in Standard ML) is defined based on the specification described by the first order predicate logic using Extended ML. The specification, the part (2) and the part (3) are frozen spot of the framework of behavioral pattern detection program. The part (2)is a hot spot of the framework that may be changed according to some behavioral patterns that we want to detect them. In 2004, we defined the specification of the program as some modules and examined the effectiveness of aspect oriented programming techniques to our framework. However, the big merit was not found compared with defining the program by only classes. In 2005, we studied and implemented a method of tracking data movement in order to detect computer virus entering via mail system. We conducted some experiments to detect the virus. Such malicious programs have some devices to make it difficult to analyze themselves. We also defined a way to make the device ineffective. We are planning to verify the validity of this framework. Less