METHOD AND DEVICE FOR EXTRACTING MESSAGE FORMAT

摘要

Examples of extracting a message format are disclosed. Extracting the message format may include capturing an execution trace of a malicious program client and identifying and analyzing a processing procedure of a message in the execution trace. An input message format is identified based on the analysis, where the input message format is of a communication protocol used by a malicious program. The examples of identifying the message format provide increase extraction efficiency, accurate analysis and positioning, and a reduced rate of false positives.

主权项

1. A method for identifying a message format, comprising:
capturing, using a processor, an execution trace of an executable program; identifying, using the processor, a processing procedure in the execution trace, the processing procedure used by the executable program to process a message received by the executable program; and extracting, using the processor, the message format by analyzing the processing procedure of the message, wherein the message format is a format used by a communication protocol of a malicious program.