Abstract:

The current mainstream of malware detection technologies includes sandbox technologies which are mainly based on malware behavior analysis. However, with the continuous development of network attack techniques, advanced malware technology will hide their malicious behavior through multi-state and deformation. In order to protect the information security of the smart grid, this paper presents an advanced online malware detection system based on virtual execution technology. The detection system increases a dynamic detection engine as well as in support of the traditional static test. Dynamic detection engine can detect advanced malware attacks through observation and analysis the changes of instruction and memory properties in depth using a virtual execution technology which is different from the traditional sandbox detection. Smart grid can effectively avoid suffering from advanced malware attacks if the online testing system is used in smart grid.

Key words: advanced malware, virtual execution, online detection, smart grid