基于分类的未知病毒检测方法研究  

Unknown Virus Detection based on Classification Method

作　　者：余晓姿[1] 马兆丰[1] 钮心忻[1] 杨义先[1] 

机构地区：[1]北京邮电大学信息安全中心,北京100876

出　　处：《信息网络安全》2012年第11期48-51,共4页Netinfo Security

基　　金：国家自然科学基金[60803157;90812001;(242)2009A105]

摘　　要：文章提出了一种以PE文件静态信息作为特征,通过分类来对未知病毒进行检测的方法。采用初始聚类中心优化的K-means聚类算法实现对病毒文件的相似度检测,无需运行PE文件即可判定是否为病毒。该方法可以克服病毒特征码扫描技术无法识别未知病毒的缺点,且相对于API序列检测方法免去了对文件进行脱壳等复杂操作,明显提高了检测速度。实验结果表明分类检测方法具有较好的准确性,有一定的应用价值。With PE file information as static characteristic, a classification method to detect unknown virus is proposed in this paper. In this paper, the K-means clustering algorithm based on the optimized initial cluster centers detects the similarity of the virus file .Without running the PE file, the classifier can determine whether it is virus or not. The method can overcome the shortage of virus feature scanning technology, which could not recognize unknown virus, and do not need for file shelling and other complex operations relative to the API sequence test methods, significantly improve the detection speed. Experiment results show that the detection method has better classification accuracy, so there is a certain practical value.

关 键 词：信息安全 文件静态信息 K均值算法 未知病毒检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]