Research on dynamic heuristic scanning technique and the application of the malicious code detection model

Highlights

• This paper investigates the heuristic scanning technique.

• The minimum distance classifier and detection model were proposed through analysis of the malicious code.

• This model can identify unknown feature codes of illegal procedures.

Abstract

With the rapid development of computer technology, people pay more attention to the security of computer data and the computer virus has become a chief threat to computer data security. By using an antivirus system that can identify randomly generated computer viruses and on the basis of the basic characteristics of the computer code, this paper investigates the heuristic scanning technique. This paper proposes the minimum distance classifier and detection model through the analysis of the malicious code. This model can identify unknown feature codes of illegal procedures and construct a healthy network environment by using a combination of model and experimental method, which can intercept the illegal virus program in the installation and operation stages.

Introduction

The rapid development of the network has brought the world within the scope of information sharing, which has significantly changed people's output and lifestyle. With the wide use of network in finance, defense, education, and other fields, there have also emerged several unsafe factors for network users. Network security has become a major issue in the process of the development of human social information. Therefore, the research on malicious code significantly contributes to improve network security.

There are several types of research on the malicious code detection technology such as the linkage of the firewall and intrusion detection technology, active defense technology, static signature detection technology, and behavior analysis technology [1]. Among them, the main technology is the behavior analysis technology, which can detect the signature of unknown illegal procedures. Furthermore, it is advantageous as it can minimize the behavior analysis. Johannes Kinder and coworkers described the malicious code by using the method of computer tree logic (CTL), and through the abstract generalization of CNF, this method has a good effect on proactive inspection, but the method can be transferred only through a level of assembly instructions. Zhangboyun used Naive Bayes and K-NN algorithms to detect unknown viruses. He also used a rough set to simplify the characteristic and avoid the loss of information. Relevant scholars from Germany placed the malicious code in the environment of the virtual machine software and analyzed the code by tracking program behavior. After repeated research of the scholars' work simultaneously at home and abroad, hackers, in order to increase the survivability of the malicious code, also adopted anti-debugging techniques to check whether the code is being debugged. Therefore, in the context of malicious behavior, we still need some security experts to study and analyze the resultant data, but the judgment process will consume much time [2].

On the basis of the results of predecessors' research, this paper has conducted further research on the malicious code detection technology. It mainly focuses on the analysis of the malicious code, discusses the description method of malicious behavior, and applies the behavior analysis technology in virus detection model. This paper provides guidance for future research in this field [3].