Application of Formal Semantics to Heuristic Anti-virus Engine
Peng Cui · 2008
The efficiency of anti-virus engine based on virtual machine technology and the Heuristic anti-virus engine are analyzed.It is found that rule selection has greatly impact on the virus judgment.Accordingly,a heuristic anti-virus engine based on formal semantics is proposed.The semantic relation frame and data structure of viruses are designed.By deeply analyzing the code structure of the contaminating parts of different viruses,typical semantic characteristics of a virus are summarized,by which the semantic relationship frame depicting its typical semantic feature is formed.In checking,the semantics embedded in the sample procedure is withdrawn,by which the semantic relation frame describing the procedure is set up.By calculating the matching degree of the two frames,whether it is a procedure including hostile program can be ascertained.Therefore,an unknown virus can be detected.