Abstract: It is difficult to generate the valid signature data for the polymorphic attack signature used in traditional string pattern mining and matching technology. In this paper, the method based on semantic awareness is proposed and tested. Firstly, the condition characteristic of polymorphic attacks data is analyzed in detail. Secondly, the original code of static semantics is extracted by applying static data flow forming process analysis. Finally, the multiple polymorphic signature data are generated in accordance with the classification standards based on SigFree method. Furthermore, the polymorphism of semantic and information related to string pattern of the code is also contained inside the data. By comparing with the experimental data of Hamsa scheme, this method is able to effectively reduce the error distortion rate of digital signature.

Key words: string pattern mining, data matching, polymorphic attack signature, the data flow, semantic perception method, data distortion