关键词: 恶意程序, 相似性, 语义特征, 结构特征

Abstract:

Most of malwares in cyberspace are not developed by the attacker, but based on the previous version to modify or directly combined from multiple malicious code. Therefore, similarity analysis is particularly important to detect malwares. Usually, only one single kind of malware characteristics is used to analyze the similarity of procedures, which can not fully identify the effective characteristics of procedures. So this paper proposes a program similarity analysis method which considers the semantic features of the basic block set of dynamic instructions and the structural features of the control flow graph. It analyzes the similarity of malicious programs from the semantic and structural dimensions, which can reach high accuracy and reliability.

Key words: malware, similarity, semantic features, structure features