权益分类	功能权益	普通用户	{{item.name}}会员
{{category.name}}	{{benefitItem.name}}

An automatic unpacking method for computer virus effective in the virus filter based on Bayesian theorem

基于贝叶斯定理的有效病毒过滤的计算机病毒自动脱壳方法

基本信息

批准号：
23500074
负责人：
KOI Yuji
金额：
$ 3.33万
依托单位：
Iwate University
依托单位国家：
日本
项目类别：
Grant-in-Aid for Scientific Research (C)
财政年份：
2011
资助国家：
日本
起止时间：
2011 至 2013
项目状态：
已结题

项目摘要

A rapid automatic virus detection algorithm using static code analysis is necessary.However,recent computer viruses are almost compressed into the executable compress format and are obfuscated.Thus,it is difficult to determine the characteristics of the binary code from the obfuscated computer viruses.In this research,a method that unpacks compressed computer viruses automatically without restriction to compression type is proposed.The proposed method unpacks the common compression formats accurately 80% of the time,while unknown compression formats can also be unpacked.The proposed method is effective against unknown viruses by combining it with the existing known virus detection system like Bayesian Virus Filter.We could achieve to implement 95% detection rates and 0.02% false detection rates.

使用静态代码分析的快速自动病毒检测算法是必要的。然而，最近的计算机病毒几乎被压缩成可执行的压缩格式，并被混淆。因此，很难从被混淆的计算机病毒中确定二进制代码的特征。本文提出了一种不受压缩类型限制的计算机病毒自动解压缩方法。该方法对常用压缩格式的解压缩准确率为80%，对未知的压缩格式也能解压缩。该方法与已有的已知病毒检测系统（如贝叶斯病毒过滤）相结合，对未知病毒有较好的检测效果。我们可以实现95%的检测率和0.02%的误检率。