产生候选鈎点以侦测恶意程式之方法及其系统;METHOD OF GENERATING IN-KERNEL HOOK POINT CANDIDATES TO DETECT ROOTKITS AND SYSTEM THEREOF

摘要

本案系提供一种判断一待测程式是否包含一恶意行为指令的方法，包含下列步骤：提供一模拟器，该模拟器具一核心及复数鈎点，该核心具有复数函数；执行该待测程式，以触动该等鈎点，并据以自该复数函数组合出复数特定函数组；以及依据该复数特定函数组之一调用顺序，以判断该待测程式是否包含该恶意行为指令。; executing the program under test to invoke these hook points, and the plurality of in-kernel functions invoked forming a combination of in-kernel functions; and based on the invocation sequence of the combination of in-kernel functions, determining whether the tested program contains instructions of the malicious behavior.