| 检测迷惑恶意代码的层次化特征选择方法 |
| |
| 引用本文： | 张健飞,陈黎飞,郭躬德. 检测迷惑恶意代码的层次化特征选择方法[J]. 计算机应用, 2012, 32(10): 2761-2767. DOI: 10.3724/SP.J.1087.2012.02761 |
| |
| 作者姓名： | 张健飞 陈黎飞 郭躬德 |
| |
| 作者单位： | 福建师范大学 数学与计算机科学学院,福州 350007 |
| |
| 基金项目： | 国家自然科学基金资助项目(61175123);福建省高校产学合作重大项目(2010H6007) |
| |
| 摘 要： | 各种迷惑恶意代码能够轻易躲避传统静态检测,而动态检测方式虽有较好的检测率,却消耗大量系统资源。为提高低系统开销下迷惑恶意代码的检测率,提出一种层次化特征选择方法,依次在引导层、个体层、家族层和全局层上生成并选择特征。层次方法以逐层精化特征的方式寻求特征冗余和信息漏选之间的平衡。实际数据集上的实验结果表明所提方法的迷惑恶意代码检测率较高,与传统特征选择方法相比,具有所需训练样本集小、泛化能力强的优点。
|
| 关 键 词： | 恶意代码检测 迷惑恶意代码 特征选择 层次方法 代码家族 |
| 收稿时间： | 2012-04-09 |
| 修稿时间： | 2012-06-07 |
Hierarchical feature selection method for detection of obfuscated malicious code |
| |
| ZHANG Jian-fei,CHEN Li-fei,GUO Gong-de. Hierarchical feature selection method for detection of obfuscated malicious code[J]. Journal of Computer Applications, 2012, 32(10): 2761-2767. DOI: 10.3724/SP.J.1087.2012.02761 |
| |
| Authors: | ZHANG Jian-fei CHEN Li-fei GUO Gong-de |
| |
| Affiliation: | School of Mathematics and Computer Science, Fujian Normal University, Fuzhou Fujian 350007, China |
| |
| Abstract: | Obfuscated malicious codes can easily escape from being detected by the conventional static method.On the other hand,despite its high detection accuracy,the dynamic method usually expends a large amount of system resources.A hierarchical feature selection method was proposed to improve the detection accuracy with relative low system overhead,where the features were generated and subsequently selected on the oriented layer,the individual layer,the family layer and the global layer,respectively.By the layer-by-layer refinements,an appropriate trade-off between the feature redundancy and information omission was archived using the hierarchical feature selection method.The experimental results on the real-world datasets demonstrate that the proposed method yields high accuracy for detecting obfuscated malicious code,while has several advantages such as smaller size of required training samples and better generalization ability compared with the conventional feature selection methods. |
| |
| Keywords: | malicious code detection obfuscated malicious code feature selection hierarchical method code family |
| 本文献已被 CNKI 等数据库收录！ |
| 点击此处可从《计算机应用》浏览原始摘要信息 |
|
点击此处可从《计算机应用》下载全文 |
|
