【摘要】 提出了一种检测恶意程序中隐式系统调用的方法。该方法使用地址栈和地址栈图来检测恶意程序中隐式的系统调用信息,其中,地址栈将每个栈的元素和栈操作的指令相结合,而地址栈图抽象地表示可执行体并且检测恶意的系统调用。通过实验表明,这是一种有效的方法。更多还原

【Abstract】 This paper presents a method to detect obfuscated system calls of malware.The idea is to use address stack and address stack graph to detect obfuscated system calls of malware.An address stack is used to associate each element in the stack to the instruction that pushes the element.An address stack graph may be created by abstract interpretation of the binary executable and may be used to detect obfuscated calls.The experiment proves the method is effective.更多还原