School of Science, Hubei University for Nationalities, China.

---

Abstract—The malicious code detection can be implemented by the characteristics of the file. Based on the variant feature codes, a method of malicious code detection is proposed in this paper. A file signature library can be set up by using the feature codes of the original data segments, file Message-Digest Algorithm 5 (MD5) features and the types of files. Both match algorithm and extended Aho-Corasick (AC) are employed to identify the signature of wildcard and location information. It can be effectively demonstrated by experimental results that compared with traditional AC algorithm, the accuracy of algorithm is increased by 15.95% and the rate of false positive is reduced by 8.87%. Furthermore, the algorithm proposed in this paper also can identify the features of malicious code variants.

Index Terms—Pattern matching algorithm, characteristics of the file, malicious code detection, extended AC algorithm.

[PDF]

Cite: Wenshuang Yin, Changcheng Xiang, Dingding Yang, and Shiqiang Chen, "A Method for Efficient Malicious Code Detection Based on Feature Codes," Journal of Software vol. 11, no. 9, pp. 952-959, 2016.