Code Confusion Confrontation Method Based on Feature Comparison
Jiesheng Zheng, Zhongzheng Tong, Guangcai Wu, Ruigang Liang · 2019
With the maturity of code hardening technology, more and more malicious applications have adopted the reinforcement technology to avoid the detection of anti-virus engines, which brings great challenges for the identification and analysis of malicious code. The paper through an in-depth analysis of common detection avoidance techniques, the technical principle of reinforcement is studied, and a code confusion countermeasure method based on feature comparison is constructed. The method takes the unobfuscated function in the target application as a reference, extracts the target application characteristics by constructing the dependency graph of the program code, and then performs code similarity query in the software gene library system constructed in this paper, and analyzes based on the query result. The code segment is similar or identical to the obfuscated code, and finally restores the confusing variable or string name based on the variable mapping relationship before and after the confusion, thereby achieving effective recovery of the obfuscated code.