基于模糊识别和支持向量机的联合Rootkit动态检测技术研究

摘要

Dynamic detection technology of Rootkit malicious code has been studied.It summarizes typical dynamic system API functions which are called by Rootkit malicious codes. It extracts behavioural characters of the typical system API functional series accompany with the running of malicious code, forms feature vectors by counting up the generating elements important degree of system call series, uses fuzzy membership function and normalization fuzzy weights vector,and comes to the fuzzy pattern recognition conclusion with the use of weighted averaging method. It exactly locates the types of Rootkit malicious code based on the analysis method of layered multi-attributes support virtual machine, according to the subtasks constructed by the independent API system call behaviours,and with the calculation of hamming distance of dynamic behaviour properties. Experiments indicates the proposed dynamic detection method of combining fuzzy pattern recognition with support virtual machine technology not only improves the accuracy rate of Rootkit automatic detection but also has the ability of detecting the previous unknown type malicious code.%针对Rootkit恶意代码动态检测技术进行研究.总结出典型Rootkit恶意程序动态行为所调用的系统API函数.实时统计API调用序列生成元并形成特征向量,通过模糊隶属函数和模糊权向量,采用加权平均法得到模糊识别的评估结果；基于层次的多属性支持向量机分析法构建子任务；基于各个动态行为属性的汉明距离定位Rootkit的类型.提出的动态检测技术提高了自动检测Rootkit的准确率,也可以用于检测未知类型恶意代码.