一种恶意代码变种检测的有效方法

为了改变基于特征码病毒查杀存在的滞后性,以及对于恶意代码变种的无效性,提出了一种基于支持向量机和模糊推理技术的恶意代码及其变种的检测方法。基于Radux原型系统,通过使用多分类机,将恶意程序进一步细分为病毒、蠕虫和木马程序,然后进行恶意代码判定的模糊推理,使得未知病毒的检测概率进一步提升,对于已有恶意程序的检测率高达99.03%,对于恶意程序变种的检测率达到93.38%。

An Effective Method for Variant of Malicious Code Detection

To change the lag caused by signature-based virus checking and killing,and the invalidity of malicious code variants,proposed a support vector machine and fuzzy reasoning and its variants of malicious code detection method.Prototype system based on Radux,through the using of multi-classifier,the malicious program is further broken down as viruses,worms and Trojan horse programs,malicious code and then determine the fuzzy reasoning,making detection of unknown viruses to further enhance the probability of looking for malicious programs have been 99.03% detection rate,for mutation detection rate of malicious programs to 93.38%.