基于关联规则的未知恶意程序检测技术  

New Malicious Executables Detection Based on Association Rules

作　　者：章文[1] 郑烇[1] 帅建梅[1] 陈超[1] 

机构地区：[1]中国科学技术大学自动化系,合肥230027

出　　处：《计算机工程》2008年第24期172-174,共3页Computer Engineering

基　　金：国家"863"计划基金资助项目(2006AA01Z449)

摘　　要：针对当前基于特征码病毒检测技术不能检测出未知病毒的缺点,通过研究某些病毒及其变种版本在执行过程中应用程序接口(API)调用序列的规律,提出一种基于数据挖掘的检测技术,采用Apriori算法从已知病毒的API调用序列中提取有价值的关联规则,用于指导病毒检测。实验结果表明该方法对未知病毒检测有良好的效果。In order to improve the current malicious detection technology based on signature, this paper presents a method based on data mining. By researching the rules of API calling sequences during executing viruses, the method uses Apriori algorithms to extract some valuable related rules which hide out in a lot of API calling sequences of viruses. These rules can be used to detect Viruses. Experimental results validate its effection.

关 键 词：关联规则 未知恶意程序 应用程序接口 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]