一种恶意软件实时检测模型

启发式扫描检测入侵行为未知的恶意软件,存在误报及漏报问题,且不能有效监控Rootkit。基于＂通过监控某种恶意行为,实现对一类入侵方式未知的恶意软件的实时检测＂的思想,提出了一种实时检测入侵行为未知恶意软件的Petri网模型,给出了性能测量及优化方法。通过在模型指导下建立的恶意软件实时检测系统中采集关键参数,完成了模型性能评价和调整。设计的系统可实时准确地检测具有特征行为的恶意软件。

A Malware Real-time Detection Model

Misreport or miss probability usually exists in the heuristic scanning for detection of unknown malware intrusions,and this could not effectively monitor the Rootkit.Based on idea ＂by monitoring some malicious behavior,to realize real-time detection of a class of malicious software with unknown intrusion way＂,a Petri net model for real-time intrusion detection of malware with unknown behavior is proposed,and the method for performance measurement and optimization also given.A malicious software real-time detection systemis established under the guidance of the model,and performance evaluation and adjustment of the model is done by collecting the key parameters in the system.The proposed real-time detection system could accurately detect the malware with characteristic behavior.