字符串特征集生成方法  

Application of Feature Selection for Unknown Malicious Detection

作　　者：赖英旭[1] 

机构地区：[1]北京工业大学计算机学院,北京100124

出　　处：《北京工业大学学报》2009年第12期1703-1709,共7页Journal of Beijing University of Technology

基　　金：国家重点基础研究发展计划资助项目(2007CB311100);北京市教委基金资助项目(KM200810005030)

摘　　要：为提高未知恶意代码的识别精度,分析了特征集的选取方法对未知恶意代码分类精度的影响,提出了一种采用字符串描述构造特征集的方法,从恶意代码或正常文件中提取出字符串原始特征,引入频繁项目集方法进行特征选择,压缩特征集维数.经比较实验结果证明,该方法可提高分类器学习效率,同时能保证分类器具有较高的分类精度.Machine learning or data mining method can identify new or unknown malicious executables with some degree of success.Feature selection is a key to applying data mining or machine learning to detect malicious executables.In order to improve detecting accuracy,a new method of extracting most representative features is purposed.The new classifier based on strings achieves has high detection rates and can be expected to perform well in real-world conditions.

关 键 词：字符串特征 未知恶意代码检测 数据挖掘 

分 类 号：TP311.52[自动化与计算机技术—计算机软件与理论]