基于改进的K-最近邻算法的病毒检测方法  

Computer Virus Detection Based on Improved K-Nearest Neighbor Algorithm

作　　者：谢金晶[1] 张艺濒[1] 

机构地区：[1]武汉大学计算机学院,湖北武汉430072

出　　处：《现代电子技术》2007年第3期51-53,共3页Modern Electronics Technique

基　　金：湖北省自然科学基金(2005ABA238)资助

摘　　要：由于计算机病毒检测的不可判定性,提出了一种基于改进的K最近邻检测方法来实现对计算机病毒的近似判别。此方法成功地克服了现有的特征码扫描技术只能检测已知病毒的缺点。首先改进了原始的K最近邻检测方法,使其更适合于对计算机病毒进行预测。并在此检测方法上,设计了一个病毒检测系统。此系统既可查杀已知病毒,也可分析评判可疑程序,诊断出被感染病毒以及病毒类型。Because precise determination of a computer virus is undecidable,a method based on improved K -nearest neighbor to detect computer virus approximately is presented in this paper. It can successfully overcome the disadvantage of normal virus scanner, which can only detect known virus. First improved the primal K -nearest neighbor algorithm, which can make it more suitable for computer virus detection. And a virus detect system based on this detect method is also designed. This system can detect known computer virus and can analysis and judge shadiness program,diagnose which kind of computer virus is infected.

关 键 词：K-最近邻算法 计算机病毒 病毒检测 INTERNET 

分 类 号：TP302.1[自动化与计算机技术—计算机系统结构]