一种基于危险理论的恶意代码检测方法  

A malicious code detection method based on danger theory

作　　者：黄聪会[1] 陈靖[1] 龚水清[1] 罗樵[1] 朱清超[1] 

机构地区：[1]空军工程大学信息与导航学院,陕西西安710077

出　　处：《中南大学学报（自然科学版）》2014年第9期3055-3060,共6页Journal of Central South University:Science and Technology

基　　金：国家自然科学基金资助项目(61172083)

摘　　要：针对当前基于多维特征检测恶意代码过程中缺乏有效的特征综合手段及检测方法问题,提出一种基于危险理论的恶意代码特征提取、融合及检测方法。该方法采用n-gram算法提取恶意代码运行时API调用序列特征,再将多个特征融合成危险信号和安全信号,最后利用确定性树突状细胞算法检测恶意代码。实验结果表明:与其他4种检测算法(朴素贝叶斯算法、决策树算法、支持向量机算法、基于实例的学习算法)相比,该方法具有更低的漏报率和误报率。Aiming at the problem that there was no effective means to synthesize features and detection method during the process of detecting malware with multi-level features, a method based on the danger theory was proposed to extract malware characteristics, synthesize them, and detect malware. This method used the n-gram algorithm to extract the runtime API call sequence features of malware, and then integrated the features into danger signal and safety signal, lastly used the deterministic dendritic cell algorithm to detect malware. The experimental results show that compared with the other four detection algorithms（Naive Bayes algorithm, decision tree algorithm, support vector machine algorithm and instance-based learning algorithm）, the proposed method has lower false negative rate and false positive rate.

关 键 词：危险理论 确定性树突状细胞算法 恶意代码检测 API调用序列 检测率 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]