恶意代码检测中的PrefixSpan算法应用  

Application of PrefixSpan Algorithm in Malware Detection

作　　者：王丽娜[1] 谭小彬[1] 潘剑锋[1] 奚宏生[1] 

机构地区：[1]中国科学技术大学自动化系,合肥230027

出　　处：《计算机工程》2010年第7期119-121,共3页Computer Engineering

基　　金：国家"863"计划基金资助项目(2006AA01Z449)

摘　　要：结合数据挖掘和专家系统技术解决主机恶意代码检测问题,提出一个基于行为的恶意代码检测系统。数据挖掘算法采用改进的序列模式挖据算法——PrefixSpan,该算法用简约投影数据库代替原PrefixSpan算法的投影数据库。PrefixSpan从恶意代码行为序列库中挖掘关联规则,专家系统将获取的主机行为与规则匹配,从而达到检测恶意行为的目的。实验结果证明了该算法的正确性和有效性。This paper proposes a behavior-based detection system, which combines data mining and expert system technique to detection malware in hosts. It applies a novel sequence pattern mining method, called PretixSpan＊, which uses brief projection database in stead of projection database in PrefixSpan. PrefixSpan＊ algorithm mines association rules in the malware behavior sequence database, to form malware behavior pattern database, the expert system matches facts and rules and gives the final result. Experimental results show that the algorithm is correct and efficient.

关 键 词：恶意代码检测 基于行为检测 序列模式挖掘 PREFIXSPAN算法 投影数据库 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]