CN106650446A - Identification method and system of malicious program behavior, based on system call - Google Patents

Abstract

The present invention provides a malicious program behavior recognition method and system based on system calls, which relate to the technical field of software behavior recognition and analysis, including acquiring feature samples, preprocessing the feature samples, and obtaining system call information; classifying the system call information, and constructing three Tuple model; quantify the elements in the triple model, obtain the similarity of system calls according to the quantified elements, and obtain the similarity of system call sequences according to the similarity of system calls; perform mining and clustering of feature samples to obtain Mining results, comparing the mining results with the detection results to obtain the comparison probability, and determine the security status of the feature samples according to the comparison probability. The invention uses a binary tool to analyze program behavior, and extracts program features from multiple dimensions, improves the accuracy and efficiency of the system, and greatly reduces the security risk of the system.

Description

Method and system for identifying malicious program behavior based on system calls

technical field

The invention relates to the technical field of software behavior identification and analysis, in particular to a system call-based malicious program behavior identification method and system.

Background technique

In recent years, the number of malicious programs has continued to grow, and there are a large number of malicious program samples to be analyzed worldwide, and information security incidents caused by malicious codes have caused huge economic losses. Security researchers and software users are eager to identify malicious programs accurately and effectively. The core technology of program behavior recognition is the technology of feature extraction and identification and classification of the type and functional characteristics of the behavioral semantic structure of the program. According to the technical principle, the current program behavior recognition technology is divided into static analysis technology and dynamic analysis technology.

Among them, the static analysis technology can cover all the execution processes and ensure the comprehensiveness of the analysis. However, due to the inconsistency between the statically analyzed code and the actually executed code, malicious code often adopts self-protection technology, resulting in a large number of available for analysis. Execution path branching, most of which are redundant, dramatically increases the number of program branches that need to be analyzed. Dynamic analysis technology has made great progress in recent years, but there are still some limitations, mainly reflected in the lack of monitoring of system calls, making it difficult to analyze malicious code at the kernel level. On the other hand, the number of execution paths covered by dynamic analysis is limited, so it is difficult to ensure the integrity of malicious code analysis, which affects the accuracy of analysis and detection.

Contents of the invention

In view of this, the object of the present invention is to provide a malicious program behavior recognition method and system based on system calls, use binary tools to analyze program behavior, and extract program features from multiple dimensions, improve system accuracy and efficiency, and greatly reduce system overhead. Security Risk.

In the first aspect, the embodiment of the present invention provides a system call-based malicious program behavior identification method, including:

Obtaining feature samples, preprocessing the feature samples, and obtaining system call information;

Classifying the system call information to construct a triple model;

Quantify the elements in the triplet model, obtain the similarity of the system calls according to the quantified elements, and obtain the similarity of the system call sequence according to the similarity of the system calls;

Mining and clustering the feature samples to obtain a mining result, comparing the mining result with the detection result to obtain a comparison probability;

Determine the security state of the feature sample according to the comparison probability.

In combination with the first aspect, the embodiment of the present invention provides a first possible implementation manner of the first aspect, wherein the acquiring feature samples, preprocessing the feature samples, and obtaining system call information include:

loading said feature samples;

performing binary instrumentation on the feature sample to obtain the system call information;

Record the system call information.

In combination with the first aspect, the embodiment of the present invention provides a second possible implementation manner of the first aspect, wherein classifying the system call information and constructing a triplet model includes:

Dividing the system call information according to functions to obtain multiple categories of information;

respectively extracting parameter feature information corresponding to a plurality of category information;

Count the time stamps of the execution of the system calls described in each category;

Constructing the triplet model according to the category information, the parameter characteristic information and the time stamp.

With reference to the second possible implementation manner of the first aspect, the embodiment of the present invention provides a third possible implementation manner of the first aspect, wherein said quantifying the elements in the triplet model includes:

extracting feature information of the semantic part of the system call;

The category information, the parameter feature information and the time stamp in the triplet model are quantified by the feature information of the semantic part.

With reference to the first aspect, the embodiment of the present invention provides a fourth possible implementation manner of the first aspect, wherein the obtaining the similarity of the system calls according to the quantified elements includes:

Calculate the similarity of the system calls according to the following formula:

Sim _function ＝category*V _category +parameter*V _parameter +time*V _time

Wherein, Sim _function is the similarity of the system call, category is the category, parameter is the parameter feature, time is the time stamp, V _category , V _parameter , and V _time respectively represent the weights assigned to category, parameter, and time.

In combination with the first aspect, the embodiment of the present invention provides a fifth possible implementation manner of the first aspect, wherein the feature samples are mined and clustered to obtain a mining result, and the mining result is compared with the detection result, Get the comparison probability, including:

performing cluster mining on the number of system calls in each category and the similarity of the system call sequences, using a clustering algorithm and setting a threshold to obtain the mining results;

Selecting the detection result related to the mining result from the knowledge database, comparing the mining result with the detection result to obtain the comparison probability, and storing the mining result as the detection result into the knowledge database.

In combination with the first aspect, the embodiment of the present invention provides a sixth possible implementation manner of the first aspect, wherein the detection result includes normal samples and malicious samples, and the determination of the feature sample according to the comparison probability Security status includes:

When the mining result is compared with the normal sample, a normal probability is obtained;

When the mining result is compared with the malicious sample, a malicious probability is obtained;

When the normal probability is greater than the malicious probability, the feature sample is in a normal program state;

When the normal probability is less than the malicious probability, the feature sample is in a state of a malicious program.

In the second aspect, the embodiment of the present invention also provides a system call-based malicious program behavior identification system, including: a feature extraction module, a system call classifier, a comparison module, and a data mining module;

The feature extraction module is connected with the system call classifier, and is used to obtain feature samples, preprocess the feature samples, and obtain system call information;

The system call classifier is connected to the comparison module, and is used to classify the system call information and construct a triple model;

The comparison module is connected with the data mining module and is used to quantify the elements in the triple model, obtain the similarity of the system calls according to the quantified elements, and obtain the similarity of the system calls according to the similarity of the system calls degree to obtain the similarity degree of the system call sequence;

The data mining module is connected with the comparison module, and is used for mining and clustering the feature samples to obtain mining results, comparing the mining results with the detection results to obtain a comparison probability, and according to The comparison probability determines the security state of the feature sample.

In combination with the second aspect, the embodiment of the present invention provides a first possible implementation manner of the second aspect, wherein the detection results include normal samples and malicious samples, and the data mining module is further configured to In the case of comparing with the normal sample, a normal probability is obtained; in the case of comparing the mining result with the malicious sample, a malicious probability is obtained.

In combination with the second aspect, the embodiment of the present invention provides a first possible implementation manner of the second aspect, wherein the data mining module is further configured to determine the The feature sample is in a normal program state; in the case that the normal probability is less than the malicious probability, it is determined that the feature sample is in a malicious program state.

Embodiments of the present invention provide a method and system for identifying malicious program behaviors based on system calls, including acquiring feature samples, preprocessing the feature samples, and obtaining system call information; classifying system call information, and constructing triplet models; The elements in the tuple model are quantified, the similarity of system calls is obtained according to the quantified elements, and the similarity of system call sequences is obtained according to the similarity of system calls; the feature samples are mined and clustered to obtain the mining results, and the mining results are Compared with the detection results, the comparison probability is obtained, and the security status of the feature sample is determined according to the comparison probability. The invention uses a binary tool to analyze program behavior, and extracts program features from multiple dimensions, improves the accuracy and efficiency of the system, and greatly reduces the security risk of the system.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

In order to make the above-mentioned objects, features and advantages of the present invention more comprehensible, preferred embodiments will be described in detail below together with the accompanying drawings.

Description of drawings

In order to more clearly illustrate the specific implementation of the present invention or the technical solutions in the prior art, the following will briefly introduce the accompanying drawings that need to be used in the specific implementation or description of the prior art. Obviously, the accompanying drawings in the following description The drawings show some implementations of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative work.

FIG. 1 is a flowchart of a system call-based malicious program behavior identification method provided by Embodiment 1 of the present invention;

FIG. 2 is a flowchart of step S100 in the system call-based malicious program behavior identification method provided by Embodiment 1 of the present invention;

FIG. 3 is a flowchart of step S110 in the system call-based malicious program behavior identification method provided by Embodiment 1 of the present invention;

FIG. 4 is a flow chart of step S120 in the system call-based malicious program behavior identification method provided by Embodiment 1 of the present invention;

FIG. 5 is a flowchart of step S130 in the system call-based malicious program behavior identification method provided by Embodiment 1 of the present invention;

FIG. 6 is a flowchart of step S140 in the system call-based malicious program behavior identification method provided by Embodiment 1 of the present invention;

FIG. 7 is a schematic structural diagram of a system call-based malicious program behavior recognition system provided by Embodiment 2 of the present invention.

icon:

10-feature extraction module; 20-system call classifier; 30-comparison module; 40-data mining module.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of them. the embodiment. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

At present, the static analysis technology can cover all execution processes, which ensures the comprehensiveness of the analysis. However, due to the inconsistency between the statically analyzed code and the actually executed code, malicious code often adopts self-protection technology, resulting in a large number of available for analysis. Execution path branches, most of which are redundant paths, dramatically increase the number of program branches that need to be analyzed. Dynamic analysis technology has made great progress in recent years, but there are still some limitations, mainly reflected in the lack of monitoring of system calls, making it difficult to analyze malicious code at the kernel level. On the other hand, the number of execution paths covered by dynamic analysis is limited, so it is difficult to ensure the integrity of malicious code analysis, which affects the accuracy of analysis and detection.

Based on this, embodiments of the present invention provide a system call-based malicious program behavior identification method and system.

In order to facilitate the understanding of this embodiment, a method for identifying malicious program behavior based on system calls disclosed in the embodiment of the present invention is firstly introduced in detail.

Embodiment one:

FIG. 1 is a flowchart of a system call-based malicious program behavior identification method provided by Embodiment 1 of the present invention.

With reference to Fig. 1, the malicious program behavior identification method based on system call comprises the following steps:

Step S100, acquiring feature samples, preprocessing the feature samples, and obtaining system call information;

Step S110, classifying the system call information to construct a triple model;

Step S120, quantify the elements in the triplet model, obtain the similarity of system calls according to the quantified elements, and obtain the similarity of system call sequences according to the similarity of system calls;

Step S130, mining and clustering the feature samples to obtain the mining results, comparing the mining results with the detection results to obtain the comparison probability;

Step S140, determine the security state of the feature sample according to the comparison probability.

Specifically, as shown in FIG. 2, in the method for identifying malicious program behavior based on system calls in the above embodiment, step S100 may be implemented by the following steps, including:

Step S201, loading feature samples;

Step S202, performing binary instrumentation on the feature samples to obtain system call information;

Step S203, recording system call information.

Here, the binary instrumentation tool is used to record the system calls and their parameters during the dynamic execution of the program.

Specifically, as shown in FIG. 3, in the method for identifying malicious program behavior based on system calls in the above embodiment, step S110 may be implemented by the following steps, including:

Step S301, dividing the system call information according to functions to obtain multiple categories of information;

Step S302, respectively extracting parameter feature information corresponding to a plurality of category information;

Step S303, counting the execution time stamps of each type of system call;

Step S304, constructing a triplet model according to category information, parameter feature information and time stamp.

Here, the structure and characteristics of each system call are analyzed, the frequency of each type of system call is counted, and the system call triplet model is established;

Among them, the triple model Table<category, parameter, time> includes the following three elements:

category indicates the category to which the system call belongs. We divide all system calls into five categories according to their execution functions: registry operation type, file operation type, process control type, memory management type, and network management type. Each of these categories is further divided into subcategories as shown in Table 1 according to rules such as the nature of operations:

Table 1 Classification of system calls

parameter indicates the parameter information passed in by the system call function, and records the relevant features to be extracted according to different classification types, as shown in Table 2:

Table 2 The parameter characteristics extracted by the system call

category Extracted parametric features registry operation KeyHandle, ObjectAttributes, SetData, etc. file operation FileHandle, Buffer, Routine, etc. process control ProcessHandle, ThreadHandle, AttributeList, etc. memory management BaseAddress, MemoryInformation, etc. network management InputBuffer, OutputBuffer, IP, Port, etc.

time is a timestamp, indicating the location where the system call was executed.

Specifically, as shown in FIG. 4, in the method for identifying malicious program behavior based on system calls in the above embodiment, in step S120, the elements in the triple model are quantified, which can be implemented by the following steps, including:

Step S401, extracting feature information of the semantic part of the system call;

Step S402, quantify the category information, parameter feature information and time stamp in the triplet model through the feature information of the semantic part.

Specifically, in the method for identifying malicious program behavior based on system calls in the above-mentioned embodiment, in step S120, the similarity of the system calls is obtained according to the quantified elements, which can be implemented by the following steps, including:

Calculate the similarity of the system call according to formula (1):

Sim _function ＝category*V _category +parameter*V _parameter +time*V _time (1)

Among them, Sim _function is the similarity of the system call, category is the category, parameter is the parameter feature, time is the timestamp, V _category , V _parameter , and V _time respectively represent the weights assigned to category, parameter, and time.

Here, the above results are normalized and then output;

Further, according to the similarity of the system call, the similarity of the system call sequence includes:

Calculate the similarity of the system call sequence according to formula (2):

Sim _sequence [i][j]＝max(Sim[i-1][j],Sim[i][j-1],Sim[i-1][j-1]+Sim _function [i][j ]) (2)

Among them, Sim _sequence [i][j] represents the similarity of two system call sequences, Sim _sequence [i] includes the similarity of i system calls, Sim _sequence [j] includes the similarity of j system calls, and the final output The result is Sim _sequence [len _a ][len _b ], where len _a and len _b respectively represent the lengths of the two system call sequences.

Specifically, as shown in FIG. 5 , in the method for identifying malicious program behavior based on system calls in the above embodiment, step S130 may be implemented by the following steps, including:

Step S501, performing cluster mining on the number of system calls in each category and the similarity of system call sequences, using a clustering algorithm and setting a threshold to obtain a mining result;

Step S502, selecting detection results related to the mining results from the knowledge database, comparing the mining results with the detection results to obtain a comparison probability, and storing the mining results as detection results in the knowledge database.

Here, in order to improve the accuracy and mining speed of the system, a clustering algorithm is used to select the most representative one or several types of data in each category, set a threshold, and merge multiple pieces of data, which reduces the complexity of the algorithm. The space complexity also improves the efficiency of the system. Therefore, this system can support malicious program behavior detection in the context of big data;

Furthermore, clustering and mining is an iterative process. Mining-clustering-mining-clustering, firstly mine data, then get the results to cluster, and then continuously improve the accuracy of mining through the clustering results, constantly compare the mining results and detection results, keep learning, and improve your next judgment the accuracy rate;

Specifically, the original mining process is carried out first. In the initial state of the system, there are some relevant mining conclusions. With the continuous increase of program samples, the incremental mining process is carried out. During the operation of the system, the detection after the last incremental mining is read. results, and read the sample knowledge about the program from the prior knowledge base, and then integrate the detection results into the knowledge database, so that the centers of these prior knowledge bases undergo a small change to adapt to the latest detection results, and continuously correct the prior Mining Algorithms for Knowledge Generation.

Among them, the incremental mining algorithm called by this system includes Bayesian classification model, decision tree classification model, etc. to incrementally mine data, and finally re-store the mining results in the mining results, replacing the original results to form a new incremental mining library , so that it can identify the new malicious sample and enhance the accuracy of data mining.

For example: Mining the program feature sample A that needs to be tested, storing the last mined test result B in the knowledge database of incremental mining, and then selecting the test result 'A related to our feature sample from the library, and The characteristic sample A is compared with the detection result 'A, and a comparison probability is obtained. In the next discrimination, A is stored in the database as the detection result.

Specifically, as shown in FIG. 6, in the method for identifying malicious program behavior based on system calls in the above embodiment, step S140 may be implemented by the following steps, including:

Step S601, when the mining result is compared with the normal sample, the normal probability is obtained;

Step S602, when the mining result is compared with the malicious sample, the malicious probability is obtained;

Step S603, when the normal probability is greater than the malicious probability, the feature sample is in a normal program state;

Step S604, when the normal probability is less than the malicious probability, the feature sample is in the state of a malicious program.

Among them, the detection results include normal samples and malicious samples. By comparing two different samples with the mining results, the normal probability and malicious probability are obtained, and then the two are compared to determine the security status of the characteristic samples.

The malicious program behavior identification method based on system call classification and sequence comparison provided by the embodiment of the present invention classifies system calls from the perspective of underlying system calls, counts the number of occurrences of each category, and claims the similarity of system call sequences. Finally, the final result of the system is guaranteed through the process of data mining. This method describes the behavioral characteristics of the program from multiple dimensions, can identify malware behavior more accurately and quickly, and improve system security.

Embodiment two:

Referring to FIG. 7 , the malicious program behavior recognition system based on system calls includes a feature extraction module 10, a system call classifier 20, a comparison module 30 and a data mining module 40;

The feature extraction module 10 is connected with the system call classifier 20, and is used to obtain feature samples, preprocess the feature samples, and obtain system call information;

System call classifier 20, connected with comparison module 30, is used to classify system call information and build triplet model;

The comparison module 30 is connected with the data mining module 40, and is used to quantify the elements in the triplet model, obtain the similarity of the system calls according to the quantified elements, and obtain the similarity of the system call sequence according to the similarity of the system calls ;

The data mining module 40 is connected with the comparison module 30, and is used for mining and clustering the feature samples to obtain mining results, comparing the mining results with the detection results to obtain a comparison probability, and determining the feature samples according to the comparison probability security status.

Further, the detection results include normal samples and malicious samples, and the data mining module 40 is also used to obtain a normal probability when the mining results are compared with the normal samples; when the mining results are compared with the malicious samples, Get malicious probability.

Further, the data mining module 40 is also used to determine that the characteristic sample is in the state of a normal program when the normal probability is greater than the malicious probability; and determine that the characteristic sample is in the state of a malicious program when the normal probability is smaller than the malicious probability.

The malicious program behavior recognition system based on system call provided by the embodiment of the present invention has the same technical features as the system call-based malicious program behavior recognition method provided by the above embodiment, so it can also solve the same technical problem and achieve the same technology Effect.

The computer program product of the system call-based malicious program behavior identification method and system provided by the embodiments of the present invention includes a computer-readable storage medium storing program codes, and the instructions included in the program codes can be used to execute the method in the preceding method embodiments. For the specific implementation of the method, refer to the method embodiments, and details are not repeated here.

Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the foregoing method embodiment, and details are not repeated here.

In addition, in the description of the embodiments of the present invention, unless otherwise clearly stipulated and limited, the terms "installation", "connection" and "connection" should be understood in a broad sense, for example, it can be a fixed connection or a detachable connection , or integrally connected; may be mechanically connected, may also be electrically connected; may be directly connected, may also be indirectly connected through an intermediary, and may be internal communication between two components. Those of ordinary skill in the art can understand the specific meanings of the above terms in the present invention in specific situations.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .

In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" etc. The indicated orientation or positional relationship is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the referred device or element must have a specific orientation, or in a specific orientation. construction and operation, therefore, should not be construed as limiting the invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and should not be construed as indicating or implying relative importance.

Finally, it should be noted that: the above-described embodiments are only specific implementations of the present invention, used to illustrate the technical solutions of the present invention, rather than limiting them, and the scope of protection of the present invention is not limited thereto, although referring to the foregoing The embodiment has described the present invention in detail, and those skilled in the art should understand that any person familiar with the technical field can still modify the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention Changes can be easily thought of, or equivalent replacements are made to some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of the present invention within the scope of protection. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (10)

1. a kind of rogue program Activity recognition method called based on system, it is characterised in that include：

Feature samples are obtained, the feature samples are pre-processed, obtain system call information；

The system call information is classified, trigram models are built；

Element in the trigram models is quantified, the similarity that the system is called is obtained according to the element for quantifying, And the similarity called according to the system obtains the similarity of system call sequence；

The feature samples are carried out into excavation cluster, Result is obtained, the Result and testing result are compared, Obtain comparing probability；

The safe condition of feature samples according to the comparison determine the probability.

2. the rogue program Activity recognition method called based on system according to claim 1, it is characterised in that described to obtain Feature samples are taken, the feature samples are pre-processed, obtaining system call information includes：

It is loaded into the feature samples；

Binary system pitching pile is carried out to the feature samples, the system call information is obtained；

Record the system call information.

3. the rogue program Activity recognition method called based on system according to claim 1, it is characterised in that it is described will The system call information is classified, and building trigram models includes：

The system call information is divided by function, multiple classification informations are obtained；

The corresponding parameter attribute information of multiple classification informations is extracted respectively；

System described in counting each classification calls the timestamp of execution；

The trigram models are built according to the classification information, the parameter attribute information and the timestamp.

4. the rogue program Activity recognition method called based on system according to claim 3, it is characterised in that it is described will Element carries out quantization in the trigram models includes：

Extract the characteristic information of the semantic component that the system is called；

By the characteristic information of the semantic component to the trigram models in the classification information, the parameter attribute letter Breath and the timestamp are quantified.

5. the rogue program Activity recognition method called based on system according to claim 1, it is characterised in that described Obtaining the similarity that the system calls according to the element for quantifying includes：

The similarity that the system is called is calculated according to following formula：

Sim_function=category^*V_category+parameter*V_parameter+time*V_time

Wherein, Sim_functionFor the similarity that the system is called, category is classification, and parameter is parameter attribute, Time is timestamp, V_category、V_parameter、V_timeRepresent respectively to the weights of category, parameter, time distribution.

6. the rogue program Activity recognition method called based on system according to claim 1, it is characterised in that the spy Levying sample carries out excavation cluster, obtains Result, and the Result and testing result are compared, and obtains comparing generally Rate, including：

The quantity and the similarity of the system call sequence that system is called described in will be of all categories carries out cluster result, using poly- Class algorithm and given threshold, obtain the Result；

The testing result related to the Result is chosen from knowledge data base, by the Result and the inspection Survey result to compare, obtain the comparison probability, and the knowledge is stored in using the Result as the testing result In database.

7. the rogue program Activity recognition method called based on system according to claim 1, it is characterised in that the inspection Surveying result includes normal sample and malice sample, the safe condition bag of the feature samples according to the comparison determine the probability Include：

When the Result is compared with the normal sample, normal probability is obtained；

When the Result is compared with the malice sample, malice probability is obtained；

When the normal probability is more than the malice probability, the feature samples are normal program status；

When the normal probability is less than the malice probability, the feature samples are rogue program state.

8. a kind of rogue program Activity recognition system called based on system, it is characterised in that including characteristic extracting module, system Calling classification device, comparing module and data-mining module；

The characteristic extracting module, is connected with the System Call Classification device, for obtaining feature samples, to the feature sample Originally pre-processed, obtained system call information；

The System Call Classification device, is connected with the comparing module, for the system call information to be classified, structure Build trigram models；

The comparing module, is connected with the data-mining module, for element in the trigram models to be quantified, Element according to quantifying obtains the similarity that the system is called, and the similarity called according to the system obtains system and calls The similarity of sequence；

The data-mining module, is connected with the comparing module, for the feature samples to be carried out into excavation cluster, obtains Result, the Result and testing result are compared, and obtain comparing probability, and according to the comparison determine the probability The safe condition of the feature samples.

9. the rogue program Activity recognition system called based on system according to claim 8, it is characterised in that the inspection Surveying result includes normal sample and malice sample, the data-mining module, is additionally operable to normal with described in the Result In the case that sample is compared, normal probability is obtained；In the situation that the Result is compared with the malice sample Under, obtain malice probability.

10. the rogue program Activity recognition system called based on system according to claim 9, it is characterised in that described Data-mining module, is additionally operable to, in the case where the normal probability is more than the malice probability, determine that the feature samples are Normal program status；In the case where the normal probability is less than the malice probability, determine that the feature samples are malice journey Sequence state.