基于属性序约简的恶意代码检测  

Malware detection based on attributes order reduction

作　　者：郭宁[1] 孙晓妍[2] 林和[1] 牟华[3] 

机构地区：[1]兰州大学信息科学与工程学院,兰州730000 [2]信息工程大学信息工程学院,郑州450002 [3]山东省情报研究所,济南250000

出　　处：《计算机应用》2011年第4期1006-1009,共4页journal of Computer Applications

摘　　要：研究了已有的恶意代码特征选择和约简方法,针对已有的属性约简方法没有充分利用特征选择评估函数信息的不足,提出以信息增益值和特征的规模对候选特征排序,并使用属性序约简对特征进行约简的方法,分析了时空复杂度,给出了总体设计方案。实验结果验证了属性序约简的应用能够在较短的时间内获得较少的约简结果,使用约简后的特征进行分类准确率较高。The existing methods of malware feature selection and reduction methods were studied.Current attribute reduction methods of malware do not take advantage of the information of feature selection evaluation function.So a method was proposed to order all features based on their value of information gain and their size,and used attributes order reduction method to get a reduction.An analysis of spatial and temporal complexity was given,and the overall design was given.Test results show that the application of attributes order reduction can obtain fewer reduction results in less time,and get higher classification accuracy using the reduction result.

关 键 词：恶意代码 特征选择 约简 信息增益 属性序 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]