利用属性自动机解析抽象行为描述的恶意软件检测
Malware Detection using Attribute-Automata to parse Abstract Behavioral Descriptions
摘要：
大多数恶意软件的行为检测器仍然特定于给定的语言和平台，主要是Windows的PE可执行文件。本文的目的是定义一个通用的方法，行为检测的基础上，分别负责抽象和检测两个层次。第一个抽象层仍然特定于一个平台和一种语言。第一层解释收集的指令、API调用和参数，并根据恶意软件生命周期中的目的对这些操作以及所涉及的对象进行分类。第二个检测层仍然是通用的，并且完全可以在不同的抽象组件之间互操作。这一层依赖于并行自动机解析属性语法，其中语义规则用于对象类型（对象分类）和对象绑定（数据流）。饲料检测和实验我们的方法，我们已经开发了两个不同的抽象组件：一个处理本地代码的系统调用跟踪和一个处理VBScript解释语言。不同的实验提供了有希望的检测率，特别是对于脚本文件（89%），几乎没有误报。在过程跟踪的情况下，检测率仍然很高（51%），但可以通过更复杂的收集工具来提高。
英文摘要：
Most behavioral detectors of malware remain specific to a given language and platform, mostly PE executables for Windows. The objective of this paper is to define a generic approach for behavioral detection based on two layers respectively responsible for abstraction and detection. The first abstraction layer remains specific to a platform and a language. This first layer interprets the collected instructions, API calls and arguments and classifies these operations as well as the involved objects according to their purpose in the malware lifecycle. The second detection layer remains generic and is totally interoperable between the different abstraction components. This layer relies on parallel automata parsing attribute-grammars where semantic rules are used for object typing (object classification) and object binding (data-flow). To feed detection and to experiment with our approach we have developed two different abstraction components: one processing system call traces from native code and one processing the VBScript interpreted language. The different experimentations have provided promising detection rates, in particular for script files (89%), with almost none false positives. In the case of process traces, the detection rate remains significant (51%) but could be increased by more sophisticated collection tools.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
