malware analysis

dynamic analysis is an important method of malware analysis. it needs to run the software and monitor its behavior. but the log provided by android is not enough for the dynamic analysis.

动态分析是恶意软件分析的一个重要方法，需要运行软件并监控其运行时的行为，而Android系统本身提供的软件运行日志不足以满足动态分析的需要。

at the same time, the malware analysis method based on symbolic execution tree also has advantages in time complexity, which significantly speeds up the analysis.

同时，基于符号执行树的分析方法在时间复杂度上也有了明显降低，提高了分析速度。

exploring multiple execution paths for malware analysis based on coverage of codes

基于代码覆盖的恶意代码多路径分析方法

AMIAS is an automated on-line processing system, which will address the massive malware analysis requirements. Third, we proposed a new malware detection method based on SVM. With the definition of combination feature, we construct SVM model for malware detection.

第三，本文提出了一种新的基于支持向量机模型的恶意代码检测方法，在组合特征定义的基础上，建立支持向量机两类分类器用于恶意代码检测。

design and implementation of an automated malware dynamic analysis system

自动的恶意代码动态分析系统的设计与实现

The group divided itself up, with DNS, sinkhole, and malware analysis subgroups.

这个工作组自发地分为DNS、黑洞、恶意软件分析等子工作组。

malware analysis is an important method to rapidly and accurately identifying the behavior of the malware, for it can improve the security of operating systems and software applications by controlling and removing malware.

恶意软件分析是快速准确的识别恶意软件行为，清除恶意软件，保护系统和其他应用程序安全的重要措施。

The automated malware integrated analysis system ( AMIAS) can extract static and dynamic behavior features, then use support vector machine to detect malware.

通过恶意代码综合分析系统（AMIAS）提取出静态和动态行为组合特征，然后使用支持向量机建立两类分类器对样本进行检测。

protocol reverse engineering is important to trusted software verification, protection and malware analysis.

网络协议的逆向分析技术无论对可信软件的验证、保护还是对恶意软件机理的分析都具有重要用途。

network intrusion reconstruction has important applications in trusted software evolution and protection in unreliable/ insecure environments as well as malware analysis.

对网络入侵过程的自动重构无论对可信软件在不可靠/不安全环境中的演化、保护还是对恶意环境的分析与检测都具有重要用途。

third, we study malware behavior automatic analysis, classify malware behavior, and make behavioral modeling, then extract malware behavior signatures to construct behavior rule database, which is used to identify malware automatically by simulating security experts.

第三，研究恶意行为自动化分析技术，对恶意行为进行分类、建模，提取恶意行为特征，构建恶意行为规则库，并模拟安全专家人工识别恶意程序的方法，自动化分析样本行为，判定行为威胁度。