产生纯化恶意程式的方法、侦测恶意程式之方法及其系统;METHOD OF GENERATING DISTILLATION MALWARE PROGRAM, METHOD OF DETECTING MALWARE PROGRAM AND SYSTEM THEREOF

摘要

本发明提出一种在一系统中产生一纯化恶意程式的方法，该方法包含下列步骤：在一训练阶段使该系统接收一良性程式以及一已知恶意程式样本。撷取在该良性程式中与安全性相关的一指令群。透过复数资料流路径来追踪与该指令群相依的一程式片段。将该程式片段分割成复数独立资料流元素。找出在该已知恶意程式样本中与该复数独立资料流元素相同的一部分程式。从该已知恶意程式样本中去除该部分程式，以产生该纯化恶意程式。; extracting an instruction set associated with security in the benign program, tracing a program slice associated with the instruction set by a plurality of data flow path; slicing the program slice into a plurality of independent data flow elements; indentifying a same part program between the known malware program sample and the plurality of independent data flow elements; and removing the same part program from the known malware program sample for generating the distillation malware program.