Detection Method Against PE Virus Based on Suspicious Behavior Identification
Qiang Wang · Jisuanji gongcheng · 2009
It is difficult to defend,detect and remove PE virus,in view of this complexion,the analysis of the key techniques of PE virus is presented to distill typical suspicious behaviors of virus.Based on it,a static detection method under Windows platform is introduced.This method,using the decompilation of program,identifies behaviors according to the analysis of instruction sequence and control flow graph,so as to complete the design of virus detection method founded on the identify of suspicious behaviors.Experimental results prove that the method is effective to detect virus with obfuscation.