关键词: PE文件,恶意代码,空间多态,多态引擎 中图法分类号TP309.5文献标识码A

Abstract: Many computer viruses use polymorphic and metamorphic techniques to mutate their code on each replication as they propagate,thus protecting themselves from antiviruses．However,there are still some disadvantages existing in traditional polymorphic and metamorphic techniques．These techniques are too difficult to implement．What`s more,it could lead to size expansion,when viruses spreading among computers．In response to these shortcomings,by analyzing the PE file frame structure,according to the characteristics that redundancy existing in the PE file,space polymorphic technique is proposed．Then,the principle of space polymorphic technique is introduced in detail,as well as the design implementation of space polymorphic engine．At last,robustness of space polymorphic technique is analysed for further research.

Key words: PE file,Malware,Space polymorphism,Polymorphic engine