基于ELF静态结构特征的恶意软件检测方法  

Malware Detection Approach Based on Structural Feature of ELF File

作　　者：白金荣[1,2] 王俊峰[1] 赵宗渠[1] 

机构地区：[1]四川大学计算机学院,四川成都610065 [2]玉溪师范学院,云南玉溪653100

出　　处：《四川大学学报（工程科学版）》2012年第5期109-114,共6页Journal of Sichuan University (Engineering Science Edition)

基　　金：国家"863"计划资助项目(2008AA01Z208);四川省青年基金资助项目(09ZQ026-028)

摘　　要：Linux平台的恶意软件检测方法目前研究较少,主要的分析手段和检测技术依然有很大的局限性。提出了一种基于ELF文件静态结构特征的恶意软件检测方法。通过对Linux平台ELF文件静态结构属性深入分析,提取在恶意软件和正常软件间具有很好区分度的属性,通过特征选择方法约减提取的特征,然后使用数据挖掘分类算法进行学习,使得能正确识别恶意软件和正常文件。实验结果显示,所使用分类算法能够以99.7%的准确率检测已知和未知的恶意软件,且检测时间较短,占用系统资源较少,可实际部署于反病毒软件中使用。Because malware detection method has been rarely studied in the Linux platform at present,the main analysis and detection methods still have a lot of limitations.A new malware detection method was proposed based on the structural feature of the ELF file.Based on in-depth analysis of the static structural information of the ELF file,the features which could distinguish between malware and the benign were extracted from the structural information of ELF file and feature selection method was applied to reduce the dimensionality of the features.The results of experiments indicated that,when the selected features are trained using classification algorithms,the proposed method has a accuracy of 99.7%,and could identify the known and unknown malware.The new detection approach has high detection accuracy with low processing overheads and less detection time and could be deployed in real-time anti-virus software.

关 键 词：恶意软件检测 结构特征 机器学习 ELF 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]