一种API动态序列分析和DAG-SVM多类支持向量机的未知病毒检测方法  

A Method Based on Dynamic Sequence Analysis of an API and DAG-SVM Multi-class Support Vector Machines of Unknown Virus Detection

作　　者：张程[1,2] 马兆丰[1,2] 钮心忻[1] 杨义先[1] 

机构地区：[1]北京邮电大学信息安全中心,北京100876 [2]北京国泰信安科技有限公司,北京100086

出　　处：《小型微型计算机系统》2012年第12期2724-2728,共5页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(60803157)资助

摘　　要：分析现有的病毒检测方法,提出一种基于特征信息熵筛选和DAG-SVM多类支持向量机的未知病毒检测新方法.该方法将PE文件静态特征扫描和动态API序列特征结合起来形成多维特征向量,并利用信息熵对静态多维特征向量进行有效性筛选,将经降维后形成的特征向量利用有向无环图多类支持向量机分类方法训练病毒学习模型并实现对未知计算机病毒的检测,该检测方法克服了特征代码扫描法无法识别未知病毒的缺陷和静态API序列检测方法对于未知病毒隐藏API调用的低识别率,使用有向无环图支持向量机相对于其他支持向量机算法可以有效的解决某些样本的误分和拒分现象.实验结果表明该病毒检测方法具有更高的准确性.This paper analyzes the existing vires detection methods and proposes a new method using feature information entropy filte- ring and DAG-SVM-based multi-class support vector machine to detect unknown virus. The method gets the multi-dimensional feature vector from the combination of PE files static characteristics scanning and dynamic API Sequence features, and uses the information entropy to filter the high-dimensional feature vector. The vector which is formed by the dimensionality reduction filter uses acyclic graph support vector machine classifier training method to achieve the identification of unknown computer viruses. This method can o- vercome the traditional feature code scanning method that cannot identify unknown viruses and the static API Sequence Analysis have a low recognition rate facing with unknown viruses which hide API calls. Using a directed acyclic graph support vector machine can effectively solve the misclassification of some samples and rejecting phenomenon in comparison with other support vector machine classification methods. Experiments show that the method has a higher accuracy.

关 键 词：信息熵增益 行为检测 多类支持向量机 未知病毒检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]