Survey on malicious code dynamic analysis evasion and anti-evasion techniques

WANG Chenyang; PENG Guojun; YANG Xiuzhang; ZHOU Yilin

doi:10.11959/j.issn.2096-109x.2025063

您当前的位置：

首页 >

文章列表页 >

Survey on malicious code dynamic analysis evasion and anti-evasion techniques

Comprehensive Reviews | 更新时间：2026-01-28

- Survey on malicious code dynamic analysis evasion and anti-evasion techniques
- Chinese Journal of Network and Information Security Vol. 11, Issue 6, Pages: 1-16(2025)
- 作者机构：
  
  1.空天信息安全与可信计算教育部重点实验室，湖北武汉 430072
  2.武汉大学国家网络安全学院，湖北武汉 430072
  3.贵州大学公共大数据国家重点实验室，贵州贵阳 550025
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(62172308;61972297;62172144;62562012);Guizhou Provincial Basic Research Program(MS[2025]686)
- DOI：10.11959/j.issn.2096-109x.2025063
  CLC： TP309.5
- Received：30 April 2025，
  
  Revised：2025-05-24，
  
  Published：25 December 2025
- 稿件说明：
移动端阅览
王晨阳, 彭国军, 杨秀璋, 等. 恶意代码动态分析对抗与反对抗技术综述[J]. 网络与信息安全学报, 2025, 11(6): 1-16.

WANG Chenyang, PENG Guojun, YANG Xiuzhang, et al. Survey on malicious code dynamic analysis evasion and anti-evasion techniques[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 1-16.
王晨阳, 彭国军, 杨秀璋, 等. 恶意代码动态分析对抗与反对抗技术综述[J]. 网络与信息安全学报, 2025, 11(6): 1-16. DOI： 10.11959/j.issn.2096-109x.2025063.

WANG Chenyang, PENG Guojun, YANG Xiuzhang, et al. Survey on malicious code dynamic analysis evasion and anti-evasion techniques[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 1-16. DOI： 10.11959/j.issn.2096-109x.2025063.

摘要

动态分析是恶意代码分析与检测的关键技术，能够刻画样本在运行时的真实行为特征。在攻防博弈的过程中，恶意代码采用动态分析对抗技术逃避分析，安全研究人员则通过反对抗技术提升分析系统应对规避型恶意软件的能力。已有综述大多聚焦于攻防技术的设计与实现，缺乏对其与恶意代码动态分析各核心环节之间关联的系统梳理。为此，该研究以恶意代码动态分析的工作流程为主线，从攻防对抗的视角出发，对相关技术进行了系统综述。首先，介绍了动态分析的典型工作流程；其次，总结了对抗技术的设计与实现方式，包括恶意载荷隐藏、分析环境感知、行为捕获逃避及分析模型欺骗技术，剖析其规避机制；再次，整理与归纳了相应的反对抗技术，包括恶意载荷捕获、环境感知规避、行为触发与监控增强及分析模型增强技术，揭示动态分析系统演变背后的攻防对抗逻辑；最后，探讨了恶意代码动态分析领域未来的发展趋势与重点研究方向，以期为恶意代码分析与检测研究提供参考。

Abstract

Dynamic analysis serves as a fundamental technique in malicious code analysis and detection

enabling the observation of real-time behaviors exhibited by malicious samples. In the ongoing adversarial arms race

malicious code employs dynamic analysis evasion techniques to evade detection

while defenders develop countermeasures to enhance the capability of dynamic analysis systems to cope with evasive malware. Existing surveys predominantly focus on the design and implementation of individual offensive and defensive techniques

lacking a comprehensive examination of their integration with the core stages of dynamic malicious code analysis. To address this limitation

a systematic survey of evasion techniques and anti-evasion techniques was conducted from an adversarial perspective

structured around the dynamic analysis workflow. First

the typical workflow of malicious code dynamic analysis was introduced. Next

the design and implementation methods of evasion techniques were summarized

including malware payload hiding

environment detection

behavior capture evasion

and analysis model deception

and their evasion strategies were analyzed. Then

the corresponding countermeasures were reviewed

including malicious payload extraction

evasion-resistant environment construction

behavior triggering and monitoring enhancements

and model hardening

and the adversarial interplay driving the evolution of dynamic analysis systems was revealed. Finally

the future development trends and key research directions in the field of dynamic analysis of malicious code were discussed

with the aim of providing references for the research on malicious code analysis and detection.

关键词

Keywords

references

工业和信息化部电子第五研究所 . 2023上半年网络安全观察报告 [R ] . 2023 .

The Fifth Research Institute of Electronics of the Ministry of Industry and Information Technology . 2023 first-half cybersecurity observation report [R ] . 2023 .

NSFOCUS . NSFOCUS reveals new botnet family RDDoS [EB ] . 2024 .

Krishnan R . Red CryptoApp: a new threat group in the ransomware world [EB ] . 2024 .

360数字安全. 2024年全球高级持续性威胁（APT）研究报告 [R ] . 2025 .

Digital Security . 2024 Global Advanced Persistent Threat (APT) Research Report [R ] . 2025 .

OR-MEIR O , NISSIM N , ELOVICI Y , et al . Dynamic malware analysis in the modern era-a state of the art survey [J ] . ACM Computing Surveys , 2019 , 52 ( 5 ): 1 - 48 .

GABER M G , AHMED M , JANICKE H . Malware detection with artificial intelligence: a systematic literature review [J ] . ACM Computing Surveys , 2024 , 56 ( 6 ): 1 - 33 .

AFIANIAN A , NIKSEFAT S , SADEGHIYAN B , et al . Malware dynamic analysis evasion techniques: a survey [J ] . ACM Computing Surveys , 2020 , 52 ( 6 ): 1 - 28 .

GENG J X , WANG J F , FANG Z Y , et al . A survey of strategy-driven evasion methods for PE malware: transformation, concealment, and attack [J ] . Computers & Security , 2024 , 137 : 103595 .

杨宇波 . 代码混淆模型研究 [D ] . 北京 : 北京邮电大学 , 2015 .

YANG Y B . Research on code obfuscation model . Beijing : Beijing University of Posts and Telecommunications , 2015 .

HOSSEINZADEH S , RAUTI S , LAURÉN S , et al . Diversification and obfuscation techniques for software security: a systematic literature review [J ] . Information and Software Technology , 2018 , 104 : 72 - 93 .

耿普 , 祝跃飞 . 路径分支混淆研究综述 [J ] . 网络与信息安全学报 , 2020 , 6 ( 2 ): 12 - 18 .

GENG P , ZHU Y F . Review of path branch obfuscation [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 2 ): 12 - 18 .

SHA Z H , SHU H , XIONG X B , et al . Model of execution trace obfuscation between threads [J ] . IEEE Transactions on Dependable and Secure Computing , 2022 , 19 ( 6 ): 4156 - 4171 .

SCHLOEGEL M , BLAZYTKO T , CONTAG M , et al . Loki: hardening code obfuscation against automated attacks [C ] // Proceedings of the 31st USENIX Security Symposium (USENIX Security) . Berkeley : USENIX Association , 2022 : 3055 - 3073 .

ZHANG Z , XUE J F , BAKER T , et al . COVER: enhancing virtualization obfuscation through dynamic scheduling using flash controller-based secure module [J ] . Computers & Security , 2024 , 146 : 104038 .

MOHSENI S , MOHAMMADI S , TILWANI D , et al . Can LLMs obfuscate code? A systematic analysis of large language models into assembly code obfuscation [C ] // Proceedings of the AAAI Conference on Artificial Intelligence (AAAI) . Washington : AAAI , 2025 , 39 ( 23 ): 24893 - 24901 .

UGARTE-PEDRERO X , BALZAROTTI D , SANTOS I , et al . SoK: deep packer inspection: a longitudinal study of the complexity of run-time packers [C ] // Proceedings of the 2015 IEEE Symposium on Security and Privacy . Piscataway : IEEE Press , 2015 : 659 - 673 .

MURALIDHARAN T , COHEN A , GERSON N , et al . File packing from the malware perspective: techniques, analysis approaches, and directions for enhancements [J ] . ACM Computing Surveys , 2022 , 55 ( 5 ): 1 - 45 .

LIU S D , PENG G J , ZENG H T , et al . A survey on the evolution of fileless attacks and detection techniques [J ] . Computers & Security , 2024 , 137 : 103653 .

CrowdStrike . CrowdStrike 2024 global threat report [R ] . 2024 .

BARR-SMITH F , UGARTE-PEDRERO X , GRAZIANO M , et al . Survivalism: systematic analysis of windows malware living-off-the-land [C ] // Proceedings of the 2021 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2021 : 1557 - 1574 .

OYAMA Y . How does malware use RDTSC? a study on operations executed by malware with CPU cycle measurement [M ] // Detection of Intrusions and Malware , and Vulnerability Assessment. Cham : Springer International Publishing , 2019 : 197 - 218 .

RAFFETSEDER T , KRUEGEL C , KIRDA E . Detecting system emulators [C ] // Proceedings of the 10th International Conference (ISC) . Berlin : Springer , 2007 : 1 - 18 .

BRENGEL M , BACKES M , ROSSOW C . Detecting hardware-assisted virtualization [C ] // Proceedings of the 13th International Conference on Detection of Intrusions and Malware , and Vulnerability Assessment (DIMVA) . Berlin : Springer , 2016 : 207 - 227 .

YOKOYAMA A , ISHII K , TANABE R , et al . SandPrint: fingerprinting malware sandboxes to provide intelligence for sandbox evasion [C ] /// Proceedings of the 19th International Symposium on Research in Attacks, Intrusions, and Defenses (RAID) . Berlin : Springer , 2016 : 165 - 187 .

ZHANG Z , CHENG Y Q , GAO Y S , et al . Detecting hardware-assisted virtualization with inconspicuous features [J ] . IEEE Transactions on Information Forensics and Security , 2020 , 16 : 16 - 27 .

SHI H , ALWABEL A , MIRKOVIC J . Car dinal pill testing of system virtual machines [C ] // Proceedings of the 23rd USENIX Security Symposium (USENIX Security) . Berkeley : USENIX Association , 2014 : 271 - 285 .

CHAILYTKO A , SKURATOVICH S . Defeating sandbox evasion: how to increase the successful emulation rate in your virtual environment [R ] . 2017 .

D’ELIA D C , COPPA E , NICCHI S , et al . SoK: using dynamic binary instrumentation for security (and how you may get caught red handed) [C ] // Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security . New York : ACM , 2019 : 15 - 27 .

MIRAMIRKHANI N , APPINI M P , NIKIFORAKIS N , et al . Spotless sandboxes: evading malware analysis systems using wear-and-tear artifacts [C ] // Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2017 : 1009 - 1024 .

KONDRACKI B , AZAD B A , MIRAMIRKHANI N , et al . The droid is in the details: environment-aware evasion of Android sandboxes [C ] // Proceedings of 2022 Network and Distributed System Security Symposium . Virginia : the Internet Society , 2022 .

FALLIERE N , MURCHU L O , CHIEN E . W32.Stuxnet dossier [R ] . Symantec Security Response , 2011 .

YASON M . The art of unpacking [R ] . 2007 .

KONG W , YANG K . Unlocking lockscreen [EB ] . 2013 .

KAWAKOYA Y , SHIOJI E , OTSUKI Y , et al . Stealth loader: trace-free program loading for API obfuscation [C ] // Proceedings of the 20th International Symposium on Research in Attacks, Intrusions, and Defenses (RAID) . Berlin : Springer , 2017 : 217 - 237 .

LI Y , KANG F , SHU H , et al . APIASO: a novel API call obfuscation technique based on address space obscurity [J ] . Applied Sciences , 2023 , 13 ( 16 ): 9056 .

ROSENBERG I , SHABTAI A , ROKACH L , et al . Generic black-box end-to-end attack against state of the art API call based malware classifiers [C ] // Proceedings of the 21st International Symposium on Research in Attacks, Intrusions, and Defenses (RAID) . Berlin : Springer , 2018 : 490 - 510 .

ROSENBERG I , SHABTAI A , ELOVICI Y , et al . Query-efficient black-box attack against sequence-based malware classifiers [C ] // Proceedings of the Annual Computer Security Applications Conference . New York : ACM , 2020 : 611 - 626 .

CHEN X H , CUI L , WEN H , et al . MalAder: decision-based black-box attack against API sequence based malware detectors [C ] // Proceedings of the 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2023 : 165 - 178 .

KUCUK Y , YAN G H . Deceiving portable executable malware classifiers into targeted misclassification with practical adversarial examples [C ] // Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy . New York : ACM , 2020 : 341 - 352 .

DIGREGORIO G , MACCARRONE S , D’ONGHIA M , et al . Tarallo: evading behavioral malware detectors in the problem space [C ] // Proceedings of the 21st International Conference on Detection of Intrusions and Malware , and Vulnerability Assessment (DIMVA) . Berlin : Springer , 2024 : 128 - 149 .

GOYAL A , HAN X Y , WANG G , et al . Sometimes, you aren’t what you do: mimicry attacks against provenance graph host intrusion detection systems [C ] // Proceedings of the 2023 Network and Distributed System Security Symposium . Virgihia : the Internet Society , 2023 .

MUKHERJEE K , WIEDEMEIER J , WANG T , et al . Evading provenance-based ML detectors with adversarial system actions [C ] // Proceedings of the 32nd USENIX Security Symposium (USENIX Security) . Berkeley : USENIX Association , 2023 : 1199 - 1216 .

SANG A Y , WANG Y C , YANG L , et al . Obfuscating provenance-based forensic investigations with mapping system meta-behavior [C ] // Proceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses . New York : ACM , 2024 : 248 - 262 .

LI S J , JIA C F , QIU P D , et al . Chosen-instruction attack against commercial code virtualization obfuscators [C ] // Proceedings of the 2022 Network and Distributed System Security Symposium . Virginia : the Internet Society , 2022 .

LUO C K , MING J , FU J M , et al . Reverse engineering of obfuscated lua bytecode via interpreter semantics testing [J ] . IEEE Transactions on Information Forensics and Security , 2023 , 18 : 3891 - 3905 .

LIU B B , SHEN J F , MING J , et al . MBA-Blast: unveiling and simplifying mixed boolean-arithmetic obfuscation [C ] // Proceedings of the 30th USENIX Security Symposium (USENIX Security 2021) . Berkeley : USENIX Association , 2021 : 1701 - 1718 .

LEE J , LEE W . Simplifying mixed Boolean-arithmetic obfuscation by program synthesis and term rewriting [C ] // Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2023 : 2351 - 2365 .

MARIANO B , WANG Z T , PAILOOR S , et al . Control-flow deobfuscation using trace-informed compositional program synthesis [C ] // Proceedings of the ACM SIGPLAN International Conference on Object-Oriented Programming Systems, Languages, and Applications (OOPSLA 2024) . New York : ACM Press , 2024 : 2211 - 2241 .

BERTRAND-VAN-OUYTSEL C H , DAM K H T , LEGAY A . Analysis of machine learning approaches to packing detection [J ] . Computers & Security , 2024 , 136 : 103536 .

LI S J , MING J , QIU P D , et al . PackGenome: automatically generating robust YARA rules for accurate malware packer detection [C ] // Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2023 : 3078 - 3092 .

CHENG B L , MING J , FU J M , et al . Towards paving the way for large-scale windows malware analysis: generic binary unpacking with orders-of-magnitude performance boost [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2018 : 395 - 411 .

CHENG B , MING J , LEAL E A , et al . Obfuscation-resilient executable payload extraction from packed malware [C ] // Proceedings of the 30th USENIX Security Symposium (USENIX Security) . Berkeley : USENIX Association , 2021 : 3451 - 3468 .

CHENG B , LEAL E A , ZHANG H , et al . On the feasibility of malware unpacking via hardware-assisted loop profiling [C ] // Proceedings of the 32nd USENIX Security Symposium (USENIX Security) . Berkeley : USENIX Association , 2023 : 7481 - 7498 .

LI Z Y , CHEN Q A , XIONG C L , et al . Effective and light-weight deobfuscation and semantic-aware attack detection for PowerShell scripts [C ] // Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2019 : 1831 - 1847 .

CHAI H J , YING L Y , DUAN H X , et al . Invoke-deobfuscation: AST-based and semantics-preserving deobfuscation for PowerShell scripts [C ] // Proceedings of the 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2022 : 295 - 306 .

LI R J , ZHANG C Y , CHAI H J , et al . PowerPeeler: a precise and general dynamic deobfuscation method for PowerShell scripts [C ] // Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2024 : 4539 - 4553 .

YANG X Z , PENG G J , ZHANG D N , et al . PowerDetector: malicious PowerShell script family classification based on multi-modal semantic fusion and deep learning [J ] . China Communications , 2023 , 20 ( 11 ): 202 - 224 .

ZHANG S F , LI S Z , LU J C , et al . Power-ASTNN: a deobfuscation and AST neural network enabled effective detection method for malicious PowerShell Scripts [J ] . Computers & Security , 2025 , 154 : 104441 .

RUARO N , PAGANI F , ORTOLANI S , et al . SYMBEXCEL: automated analysis and understanding of malicious excel 4.0 macros [C ] // Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2022 : 1066 - 1081 .

李晨光 , 杨秀璋 , 彭国军 . Excel 4.0宏自动化反混淆与家族分类系统 [J ] . 网络与信息安全学报 , 2024 , 10 ( 3 ): 66 - 80 .

LI C G , YANG X Z , PENG G J . Automated deobfuscation and family classification system for Excel 4.0 macros [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 3 ): 66 - 80 .

ONGUN T , STOKES J W , OR J B , et al . Living-off-the-land command detection using active learning [C ] // Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses . New York : ACM , 2021 : 442 - 455 .

RUAN B N , LIU J H , ZHANG C Q , et al . KernJC: automated vulnerable environment generation for Linux kernel vulnerabilities [C ] // Proceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses . New York : ACM , 2024 : 384 - 402 .

杨秀璋 , 彭国军 , 李子川 , 等 . 基于Bert和BiLSTM-CRF的APT攻击实体识别及对齐研究 [J ] . 通信学报 , 2022 , 43 ( 6 ): 58 - 70 .

YANG X Z , PENG G J , LI Z C , et al . Research on entity recognition and alignment of APT attack based on Bert and BiLSTM-CRF [J ] . Journal on Communications , 2022 , 43 ( 6 ): 58 - 70 .

LI Z Y , ZENG J , CHEN Y , et al . AttacKG: constructing technique knowledge graph from cyber threat intelligence reports [C ] /// Proceedings of the 27th European Symposium on Research in Computer Security (ESORICS 2022) . Berlin : Springer , 2022 : 589 - 609 .

XU M , WANG H , LIU J , et al . IntelEX: a LLM-driven attack-level threat intelligence extraction framework [J ] . arXiv preprint , arXiv: 2412. 10872 , 2024 .

HOSSAIN M N , MILAJERDI S M , WANG J A , et al . SLEUTH: real-time attack scenario reconstruction from COTS audit data [C ] // Proceedings of the 26th USENIX Security Symposium (USENIX Security 2017) . Berkeley : USENIX Association , 2017 : 487 - 504 .

ZENG J , ZHANG C Q , LIANG Z K . PalanTír: optimizing attack provenance with hardware-enhanced system observability [C ] // Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2022 : 3135 - 3149 .

SONG Y B , WANG K H , SUN X , et al . A multi-source log semantic analysis-based attack investigation approach [J ] . Computers & Security , 2025 , 150 : 104303 .

MILAJERDI S M , GJOMEMO R , ESHETE B , et al . HOLMES: real-time APT detection through correlation of suspicious information flows [C ] // Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2019 : 1137 - 1152 .

RABOOKI S F , LI B , FEBRINANTO F G , et al . GraphDART: graph distillation for efficient advanced persistent threat detection [J ] . arXiv preprint , arXiv: 2501. 02796 , 2025 .

HAN X Y , PASQUIER T , BATES A , et al . Unicorn: runtime provenance-based detector for advanced persistent threats [C ] // Proceedings of the 2020 Network and Distributed System Security Symposium . Virginia : the Internet Society , 2020 .

WANG S , WANG Z L , ZHOU T , et al . THREATRACE: detecting and tracing host-based threats in node level through provenance graph learning [J ] . IEEE Transactions on Information Forensics and Security , 2022 , 17 : 3972 - 3987 .

CHENG Z J , LV Q J , LIANG J Y , et al . Kairos: practical intrusion detection and investigation using whole-system provenance [C ] // Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2024 : 3533 - 3551 .

D’ELIA D C , COPPA E , PALMARO F , et al . On the dissection of evasive malware [J ] . IEEE Transactions on Information Forensics and Security , 2020 , 15 : 2750 - 2765 .

GALLORO N , POLINO M , CARMINATI M , et al . A systematical and longitudinal study of evasive behaviors in windows malware [J ] . Computers & Security , 2022 , 113 : 102550 .

DINABURG A , ROYAL P , SHARIF M , et al . Ether: malware analysis via hardware virtualization extensions [C ] // Proceedings of the 15th ACM Conference on Computer and Communications Security . New York : ACM , 2008 : 51 - 62 .

NGUYEN A M , SCHEAR N , JUNG H , et al . MAVMM: lightweight and purpose built VMM for malware analysis [C ] // Proceedings of the 2009 Annual Computer Security Applications Conference . Piscataway : IEEE Press , 2009 : 441 - 450 .

DENG Z , ZHANG X Y , XU D Y . SPIDER: stealthy binary program instrumentation and debugging via hardware virtualization [C ] // Proceedings of the 29th Annual Computer Security Applications Conference . New York : ACM , 2013 : 289 - 298 .

KARVANDI M S , GHOLAMREZAEI M , KHALAJ MONFARED S , et al . HyperDbg: reinventing hardware-assisted debugging [C ] // Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2022 : 1709 - 1723 .

KIRAT D , VIGNA G , KRUEGEL C . BareCloud: bare-metal analysis-based evasive malware detection [C ] // Proceedings of the 23rd USENIX Security Symposium (USENIX Security) . Berkeley : USENIX Association , 2014 : 287 - 301 .

SPENSKY C , HU H Y , LEACH K . LO-PHI: low-observable physical host instrumentation for malware analysis [C ] // Proceedings of the 2016 Network and Distributed System Security Symposium . Virginia : the Internet Society , 2016 .

BOTACIN M , DE-GEUS P L , GRÉGIO A . Enhancing branch monitoring for security purposes: from control flow integrity to malware analysis and debugging [J ] . ACM Transactions on Privacy and Security , 2018 , 21 ( 1 ): 1 - 30 .

ZHANG F W , LEACH K , STAVROU A , et al . Using hardware features for increased debugging transparency [C ] // Proceedings of the 2015 IEEE Symposium on Security and Privacy . Piscataway : IEEE Press , 2015 : 55 - 69 .

KIRAT D , VIGNA G . MalGene: automatic extraction of malware analysis evasion signature [C ] // Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2015 : 769 - 780 .

BALZAROTTI D , COVA M , KARLBERGER C , et al . Efficient detection of split personalities in malware [C ] // Proceedings of the 17th Network and Distributed System Security Symposium (NDSS 2010) . Virginia : the Internet Society , 2010 .

LINDORFER M , KOLBITSCH C , MILANI COMPARETTI P . Detecting environment-sensitive malware [C ] // Proceedings of the 14th International Symposium on Recent Advances in Intrusion Detection (RAID 2011) . Berlin : Springer , 2011 : 338 - 357 .

KOLBITSCH C , KIRDA E , KRUEGEL C . The power of procrastination: detection and mitigation of execution-stalling malicious code [C ] // Proceedings of the 18th ACM Conference on Computer and Communications Security . New York : ACM , 2011 : 285 - 296 .

KÜCHLER A , MANTOVANI A , HAN Y F , et al . Does every second count? time-based evolution of malware behavior in sandboxes [C ] // Proceedings of the 2021 Network and Distributed System Security Symposium . Virginia : the Internet Society , 2021 .

XU Z Y , ZHANG J L , GU G F , et al . GoldenEye: efficiently and effectively unveiling malware’s targeted environment [C ] // Proceedings of the 17th International Symposium on Research in Attacks, Intrusions and Defenses: (RAID) . Berlin : Springer , 2014 : 22 - 45 .

ALAEIYAN M , PARSA S , CONTI M . Analysis and classification of context-based malware behavior [J ] . Computer Communications , 2019 , 136 : 76 - 90 .

ALAEIYAN M , PARSA S , VINOD P . Sober: explores for invasive behaviour of malware [J ] . Journal of Information Security and Applications , 2023 , 74 : 103451 .

PENG F , DENG Z , ZHANG X , et al . X-Force: force-executing binary programs for security applications [C ] // Proceedings of the 23rd USENIX Security Symposium (USENIX Security) . Berkeley : USENIX Association , 2014 : 829 - 844 .

YOU W , ZHANG Z , KWON Y , et al . PMP: cost-effective forced execution with probabilistic memory pre-planning [C ] // Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP 2020) . Piscataway : IEEE Press , 2020 : 1121 - 1138 .

HE D N , XIE D C , WANG Y J , et al . Define-use guided path exploration for better forced execution [C ] // Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2024 : 287 - 299 .

ZHAN D Y , TAN K , YE L , et al . An adversarial robust behavior sequence anomaly detection approach based on critical behavior unit learning [J ] . IEEE Transactions on Computers , 2023 , 72 ( 11 ): 3286 - 3299 .

GOYAL A , WANG G , BATES A . R-CAID: embedding root cause analysis within provenance-based intrusion detection [C ] // Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP 2024) . Piscataway : IEEE Press , 2024 : 3515 - 3532 .

COSCIA A , LORUSSO R , MACI A , et al . APIARY: an API-based automatic rule generator for yara to enhance malware detection [J ] . Computers & Security , 2025 , 153 : 104397 .

UETZ R , HERZOG M , HACKLÄNDER L , et al . You can not escape me: detecting evasions of SIEM rules in enterprise networks [C ] // Proceedings of the 33rd USENIX Security Symposium (USENIX Security) . Berkeley : USENIX Association , 2024 : 5179 - 5196 .

杨秀璋 , 彭国军 , 刘思德 , 等 . 面向APT攻击的溯源和推理研究综述 [J ] . 软件学报 , 2025 , 36 ( 1 ): 203 - 252 .

YANG X Z , PENG G J , LIU S D , et al . Survey on attribution and inference research for APT attacks [J ] . Journal of Software , 2025 , 36 ( 1 ): 203 - 252 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Malicious code within model detection method based on model similarity

Malware prediction technique based on program gene

Research on host malcode detection using machine learning

Static-analysis-based event input generation approach for Android application

Toward discovering and exploiting private server-side Web API

Related Author

Fan YANG

Qi GAO

Chuanxin ZHOU

Yi SUN

Degang WANG

Suoxing ZHANG

Xiaochen WANG

Baojiang CUI

Related Institution

School of Cyberspace Security,Beijing University of Post and Telecommunications

National Engineering Lab for Mobile Network Security

School of Computer Science and Technology,Shandong University

Key Laboratory of Cryptologic Technology and Information Security,Ministry of Education,Shandong University

Information Security Research Center,Southeast University

⁰