Semantic detection of malicious code based on the normalized system call

This paper presents a new semantic detection of malicious code method based on the normalized system call to obtain perfect malicious code system sequence and related parameters through the control of virtual environment, And to normalize the called sequence again. In order to effectively determine the malicious code, we establish a highly efficient abstract behavior vector´s database of malicious code. By a large number of malicious codes experimental verification, the method is compared with existing methods that can be more accurate description of the malicious code attacks based on system call, and effectively in identifying unknown malicious code.