关键词: 串模式挖掘, 数据匹配, 多态攻击签名, 数据流, 语义感知方法, 数据失真

Abstract: It is difficult to generate the valid signature data for the polymorphic attack signature used in traditional string pattern mining and matching technology. In this paper, the method based on semantic awareness is proposed and tested. Firstly, the condition characteristic of polymorphic attacks data is analyzed in detail. Secondly, the original code of static semantics is extracted by applying static data flow forming process analysis. Finally, the multiple polymorphic signature data are generated in accordance with the classification standards based on SigFree method. Furthermore, the polymorphism of semantic and information related to string pattern of the code is also contained inside the data. By comparing with the experimental data of Hamsa scheme, this method is able to effectively reduce the error distortion rate of digital signature.

Key words: string pattern mining, data matching, polymorphic attack signature, the data flow, semantic perception method, data distortion