多类支持向量机的病毒行为检测方法  

Behavior-based virus detection method using multi-class support vector machine

作　　者：韩兰胜[1] 邹梦松[1] 刘其文[1] 刘铭[1] 

机构地区：[1]华中科技大学计算机科学与技术学院,武汉430074

出　　处：《计算机应用》2010年第1期181-185,共5页journal of Computer Applications

基　　金：国家自然科学基金资助项目(60703048);湖北省自然科学基金资助项目(2007ABA313;2008CDB352)

摘　　要：与正常程序相比,病毒具有一些特殊的、有限的行为。运用支持向量机的方法,构建出病毒的特征行为空间,采用信息熵来放大病毒行为与正常程序的区别,通过学习分类寻找并建立将不同程序行为切分的超平面,再对不同类型病毒的特征行为进行区分。通过对大量正常程序与病毒程序中的API调用的统计和分析,发现了病毒的API调用数量和分布的特征,将行为特征集中API调用序列设定为2100就可以将所实验的病毒检出,这保证了检测集的稳定性和检测的可行性。与已有的病毒检测方法进行比较,所提出的方法更加具有操作性。In order to achieve specific functions, computer viruses are of some special behaviors different from those of the normal programs. Appling Support Vector Machine （ SVM）, the paper created a space of virus API feature vector and amplified the difference between normal programs and computer virus with the help of information entropy. By training a classifier, a hyper-plane was found, which could divide the API space into two parts, each of which represented one kind of the programs. Moreover, the paper collected behaviors of different kinds of viruses. Through statistics, analysis and calculation on amount of samples＇ API calls, the amount and distribution patterns of APIs were exposed. As most viruses＇ behaviors are finite, the paper set 2 100 as the length of API sequence, thus detecting most test viruses. Compared with previous virus detection methods, the proposed method is more practical.

关 键 词：计算机病毒 行为检测 信息熵 多类分类 信息增益 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]