Abstract: As the rapid development of Internet, web security issues have become increasingly prominent. The client is the focus of web applications, more and more rich client applications have provide a better experience for users, but malicious codes appear for the client. These malicious codes can be divided into two types of boot and destructive, and they attack various vulnerabilities for client systems. The quantity of these codes is growing faster, and so much variants have been or will be produced for these codes. Some codes are encrypted to hide their true purpose. Because of the concealment for malicious codes, it is difficult to directly determine the authenticity of malicious codes. Sandbox can provide a secure environment for malicious codes to expose their behavior and find the characteristics. By this way malicious codes can be killed better. It can reveal the hidden malicious code and also verify the feasibility of these detection methods through a number of virus samples tested.

Key words: malicious code, sandbox, signature