基于K-最近邻算法的未知病毒检测  

Unknown Computer Virus Detection Based on K-Nearest Neighbor Algorithm

作　　者：张波云[1] 殷建平[1] 张鼎兴[1] 嵩敬波[1] 

机构地区：[1]国防科技大学计算机学院

出　　处：《计算机工程与应用》2005年第6期7-10,共4页Computer Engineering and Applications

基　　金：国家自然科学基金项目(编号:60373023)资助

摘　　要：因为准确检测计算机病毒是不可判定的,故该文提出了一种基于实例学习的k-最近邻算法来实现对计算机病毒的近似检测。该法可以克服病毒特征代码扫描法不能识别未知病毒的缺点。在该检测方法的基础上,文章设计了一个病毒检测网络模型,此模型适用于实时在线系统中的病毒检测,既可以实现对已知病毒的查杀,又可以对可疑程序行为进行分析评判,最终实现对未知病毒的识别。Because precise determination of a virus by its appearance is undecidable,a K-nearest neighbor Algorithm based on sample learning to detect computer virus approximately is presented in this paper.It can overcome the short-age of normal virus scanner-which can not detect unknown virus.Based on this method,a virus detect network model is designed also.This model fits to detect viurs in the on-line system,it alse detect known and unknown computer virus by analyzing the program's behavior.

关 键 词：计算机病毒 K-最近邻算法 病毒检测 

分 类 号：TP309.05[自动化与计算机技术—计算机系统结构]