中圖分類號：TP393.08 文獻標志碼：A DOI: 10.16157/j.issn.0258-7998.256446 中文引用格式： 袁偉峰，沙樂天，潘家曄. 一種基于數(shù)據(jù)匹配的COM惡意調(diào)用溯源研究[J]. 電子技術(shù)應(yīng)用，2025，51(9)：50-55. 英文引用格式： Yuan Weifeng，Sha Letian，Pan Jiaye. A data matching-based study on tracing malicious COM calls[J]. Application of Electronic Technique，2025，51(9)：50-55.
A data matching-based study on tracing malicious COM calls
Yuan Weifeng，Sha Letian，Pan Jiaye
School of Computer Science， Nanjing University of Posts and Telecommunications
Abstract： To address the challenge of Advanced Persistent Threats (APTs) leveraging Component Object Model (COM) interfaces to obfuscate malicious activities, rendering traditional tracing methods ineffective, this study proposes COMLink, a real-time provenance analysis system based on data matching. COMLink leverages the data association characteristics inherent in data exchange between client and server processes during COM calls, employing a prefix similarity algorithm to achieve precise, thread-level provenance for sensitive behaviors. COMLink is capable of cross-process tracing of COM call chains, enabling effective provenance analysis even when malware exploits trusted processes to execute malicious actions. Experimental results demonstrate that COMLink can trace COM-based attack behaviors with an accuracy of 82% in a test environment comprising 6 known exploitable COM interfaces. COMLink's impact on system performance is negligible, with a performance loss of less than 2%, significantly enhancing APT detection and attribution capabilities.
Key words : Advanced Persistent Threat （APT）；malware detection；Component Object Model （COM）；Windows malware
