关键词: 非法程序, 虚拟机, 行为分析, 误报率, 漏报率

Abstract: Concerning the feature that the technology of characteristic code is unable to detect new and unknown baleful program, an auto-detection system of suspicious file based on technology of virtual machine and behavior analysis was proposed. Work diagram of detection system was introduced with emphasis, module framework of management center and detection center of the system was given, and the technical principle of management center and detection center was analyzed in detail. The experimental results show that the system can judge rapidly the dangerous level of one detected file and the system has long life cycle.

Key words: baleful program, Virtual Machine （VM）, behavior analysis, misinformation rate, unreported rate