Recognition method for network script virus based on statistical analysis

Network script virus take up a large percentage of current network viruses and it is very hard for using traditional methods to detect them, especially the mutation of script virus, because of its flexible programming format. Unknown network script virus can barely be identified. In this paper, a recognition method for network script virus based on statistical analysis is proposed. This method uses static analysis to identify the dangerous key words of script virus, and then monitors the executables at runtime to verify its virus features. The leading idea of this technique is that analyze the plain text of the script virus, obtain its dangerous key words statistical information, and recognize the script virus by that knowledge. Experiment result shows that this technique is highly effective on recognition rate.