基于动态行为的未知恶意代码识别方法

＂特征码＂法虽然可以准确地检测出已知的恶意代码,但是对未知的恶意代码的识别却无能为力.目前基于代码动态行为的分析方法是未知恶意代码检测技术的发展方向.本文通过对未知恶意代码在植入、安装及启动时调用的API序列作为依据,并分别使用最小距离分类器、K-最近邻、余弦相似度等分类方法对它进行识别,实验表明：对于未知恶意代码的识别,不同的分类算法有不同的优缺点,所以,具体选择哪个算法,要根据恶意代码识别的具体要求而定.

An Identification Method on Unknown Malicious Code Based on Dynamic Behaviour

Although the method of feature code can identify the known malicious code,it is helpless against the unknown malicious code.By now,the method based on behavior analysis is the direction of malicious code detection.This paper takes the API sequences called by code as the detection basis to determine whether the code is malicious or not when the code is implanted,installed or launched,and employs minimum distance classifier,K-the nearest and cosine similarity to distinguish them respectively.The experiments result shows that different methods have different advantages and disadvantages,so the choice of different method depends on different demand.