基于加密规则的恶意代码安全检测关键技术研究

Along with the more and more widely application of the computer and network in our daily life, and the battle field moved from the traditional sea and air to the network space, the research of malcode detection is especially important to our society and has become one of the most important research directions in the area of network security. However, it is more difficult than before to detect the software products because of intellectual property, information security and business competition and other factors. Thus, the software products need to protect the key codes while being detected. On the other hand, in order to prevent from the combating and immunity of the malcode, the confidentiality of the detection technology itself needs to be protected. Therefore, this project focuses on the research on malcode detection technologies based on encrypted detection rules to protect the security of both detection rules and detected codes by applying naïve Bayesian and homomorphic encryption. This project helps to promote China's information industry toward legalization and standardization as well as to the healthy development of software products and network security. It is of great significance to the society and economy, and the malcode detection technologies based on the encrypted detection rules which can protect the security of both detection rules and detected codes is also the inevitable development trend of malcode detection in the future.

恶意代码检测是网络安全领域的重点研究内容，随着互联网在人们日常生活的广泛应用以及现代作战方式由传统海陆空作战走向网络空间作战，其重要性对人民生活乃至国家安全不言而喻。与此同时，由于人们知识产权观念、信息安全意识的增强以及商业竞争加剧等因素，各类软件产品的关键信息被严格保护；而为了防止恶意代码对检测技术的对抗和免疫，检测规则的保密性也至关重要。基于此，本项目提出“基于加密规则的恶意代码安全检测关键技术研究”，从软件信息和检测规则两方面考虑，利用加密的朴素贝叶斯检测规则对软件进行检测识别，在确保检测规则和模型保密的基础上保护软件的关键信息，实现检测代码和检测技术的双重安全，既保护软件产品相关的知识产权和核心技术，又维护检测技术的效用。本项目有助于推动我国信息行业走向法制化、规范化，有助于软件产品行业以及网络安全的健康发展，具有重要的社会意义和经济价值，也是未来恶意代码安全检测的必然发展趋势。

恶意代码数量庞大、种类繁多、高感染、强破坏，对现代互联网的安全与稳定发展带来了巨大威胁，而新技术新手段的出现使得恶意代码变得更加智能和高级，一方面，恶意代码一改原来简单嵌入正常代码的攻击方式，与软件产品功能相结合，经过精心编制、利用正常代码或者与正常程序交错纠缠在一起进行伪装来执行恶意行为，大大增加了检测难度；另一方面，即便能够检测出某种恶意代码，由于目前对检测技术没有保护措施，一旦检测方法被恶意软件反分析利用，现有的检测规则不仅会丧失效能，一定程度上还增强了恶意代码的生存能力。针对这两点，课题组开展了基于加密规则的恶意代码安全检测关键技术研究，通过建立加密规则的朴素贝叶斯检测模型，构造加密的朴素贝叶斯分类器；利用关键API特征提取技术训练待测软件代码组建软件待测API序列库；然后根据加密的朴素贝叶斯分类器对待测API序列进行保护隐私的分类识别，实现了检测规则和检测代码双重安全的恶意代码安全检测。既保护检测技术本身的保密性，又保护被检测代码的隐私，在对软件进行安全性评估和分类识别的同时排除嵌入恶意代码的可疑软件，有效防止恶意代码的植入和传播，为恶意代码检测走向保护隐私的安全检测提供了可供借鉴的技术手段，对互联网软件行业以及整个网络安全领域的和谐、健康发展有重要的社会意义和经济价值。