采用Win32 API相关行为分析的未知病毒检测方法  

Method of unknown virus detection based on analysis of Win32 API behaviors

作　　者：刘帅 吴艳霞[1] 马春光[1] 顾国昌[1] 龙勤 

机构地区：[1]哈尔滨工程大学计算机科学与技术学院,哈尔滨150001 [2]英特尔亚太研发有限公司,上海200241

出　　处：《计算机工程与应用》2011年第27期119-121,131,共4页Computer Engineering and Applications

基　　金：中央高校基本科研业务费专项资金(No.HEUCF100606;No.HEUCF100604);国家教育部博士点专项基金(No.20092304120013);黑龙江省青年科技专项基金(No.QC08C39)~~

摘　　要：针对目前基于行为分析的未知病毒检测方法需要运行可执行程序,无法检测出以静态形式存在计算机中的滴管等病毒的问题,提出了一种基于Win32 API相关行为检测PE未知病毒的方法。首先解析PE文件提取其调用的敏感Win32 API函数,然后将这些API函数按相关的恶意行为分类并形成维数固定的特征行为向量存入数据库。采用基于判别熵最小化的特征提取法自适应的精简特征项,最后利用改进的K-最近邻算法进行分类。实验结果表明,该方法具有较高的命中率和较低的漏判率,适用于"云安全"系统中未知病毒的检测。In view of the current behavior-based unknown virus detection methods need to run executable programs and can＇t detect static virus such as dropper,the static method based on Win32 API behaviors for detecting unknown virus is proposed.Firstly parsing PE files to extract the sensitive Win32 API calls,then classifying the API functions based on malicious behavior and conducting a fixed dimension characteristic behavior vector into a database.With the feature extraction method of minimizing discriminant entropy,the redundant feature items are reduced,finally the improved K-Nearest Neighbor（KNN） algorithm is used to classify.The experiment results show that the method has a high hit rate and lower missing rate,suitable for unknown virus detection in Cloud Security system.

关 键 词：未知病毒检测 特征提取 K-最近邻算法 精简特征项 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]