集成时空信息的木马智能检测  

Trojan Intelligent Detection Based on Ensemble of Spatio-temporal Information

作　　者：孙晓妍[1] 郭宁[2] 黄茜 祝跃飞[1] 

机构地区：[1]解放军信息工程大学信息工程学院 [2]兰州大学信息科学与工程学院 [3]解放军61046部队

出　　处：《小型微型计算机系统》2012年第4期778-784,共7页Journal of Chinese Computer Systems

摘　　要：木马已成为当前信息安全的重要威胁.研究了已有的恶意代码智能检测方法,针对已有的智能检测没有充分利用时序和空间信息的缺陷,提出集成时序和空间信息的木马行为智能检测.给出了时序特征和空间特征的提取方法,并给出空间特征的特征选择和约简过程,并在此基础上给出了成员分类器的集成决策.给出了总体设计方案,实验结果表明集成时序和空间信息的木马智能检测相对于单分类器能够得到较好的分类准确率.Trojan horse has become a major threat to information security. This paper studied the existing intelligent detection of mali- cious code. Current detection method did not take full use of spatial-temporal information. So this paper proposed intelligent detection method of Trojan based on ensemble of spatial-temporal information. It gave the feature extraction methods of temporal and spatial features, and gave selection and reduction process of spatial features, and the ensemble method of member classifiers. In the end, it gave the overall design, and experimental results showed that the intelligent detection method of Trojan based on ensemble of spatial- temporal information could achieve better classification accuracy comparing to single classifier.

关 键 词：木马 智能检测 时序特征 空间特征 集成 

分 类 号：TP302[自动化与计算机技术—计算机系统结构]