论文标题
恶意软件检测和分析的工具和技术
Tools and Techniques for Malware Detection and Analysis
论文作者
论文摘要
当今互联网面临的主要和严重威胁之一是需要评估潜在恶意意图的大量数据和文件。恶意软件（通常称为攻击者设计的恶意软件）本质上是多态和变质的，它们具有随着传播而更改代码的能力。此外，其变体的多样性和数量严重破坏了传统防御的有效性，这些防御通常使用基于签名的技术，无法检测到以前未知的恶意可执行文件。恶意软件家族的变体具有典型的行为模式，反映了其起源和目的。可以利用静态或动态上获得的行为模式，以使用机器学习技术将未知的恶意软件检测到其已知家庭。该调查文件概述了用于检测和分析恶意软件的技术和工具。
One of the major and serious threats that the Internet faces today is the vast amounts of data and files which need to be evaluated for potential malicious intent. Malicious software, often referred to as a malware that are designed by attackers are polymorphic and metamorphic in nature which have the capability to change their code as they spread. Moreover, the diversity and volume of their variants severely undermine the effectiveness of traditional defenses which typically use signature based techniques and are unable to detect the previously unknown malicious executables. The variants of malware families share typical behavioral patterns reflecting their origin and purpose. The behavioral patterns obtained either statically or dynamically can be exploited to detect and classify unknown malware into their known families using machine learning techniques. This survey paper provides an overview of techniques and tools for detecting and analyzing the malware.
