基于ELF静态结构特征的恶意软件检测方法

Linux平台的恶意软件检测方法目前研究较少,主要的分析手段和检测技术依然有很大的局限性。提出了一种基于ELF文件静态结构特征的恶意软件检测方法。通过对Linux平台ELF文件静态结构属性深入分析,提取在恶意软件和正常软件间具有很好区分度的属性,通过特征选择方法约减提取的特征,然后使用数据挖掘分类算法进行学习,使得能正确识别恶意软件和正常文件。实验结果显示,所使用分类算法能够以99.7%的准确率检测已知和未知的恶意软件,且检测时间较短,占用系统资源较少,可实际部署于反病毒软件中使用。

Malware Detection Approach Based on Structural Feature of ELF File

With the increasing development and application of Linux, more disruptive malware appeared in the Linux platform. Because malware detection method is rarely studied in the Linux platform at present, the main analysis and detection methods still have a lot of limitations. This paper proposed a new malware detection method based on the structure feature of the ELF file. Based on in-depth analysis of the static structure information of the ELF file, the features which can distinguish between malware and the benign were extracted from the structural information of ELF file and feature selection method was applied to reduce the dimensionality of the features. When the selected features were trained using classification algorithms, the results of our experiments indicate that the accuracy of our method reaches 99.7% and our method can identify the known and unknown malware. The new detection approach achieved high detection accuracy with low processing overheads and less detection time and could be deployed in real-time anti-virus software.