字符串特征集生成方法

为提高未知恶意代码的识别精度,分析了特征集的选取方法对未知恶意代码分类精度的影响,提出了一种采用字符串描述构造特征集的方法,从恶意代码或正常文件中提取出字符串原始特征,引入频繁项目集方法进行特征选择,压缩特征集维数.经比较实验结果证明,该方法可提高分类器学习效率,同时能保证分类器具有较高的分类精度.

Application of Feature Selection for Unknown Malicious Detection

Machine learning or data mining method can identify new or unknown malicious executables with some degree of success. Feature selection is a key to applying data mining or machine learning to detect malicious executables. In order to improve detecting accuracy, a new method of extracting most representative features is purposed. The new classifier based on strings achieves has high detection rates and can be expected to perform well in real-world conditions.