一种恶意代码特征选取和建模方法  

A FEATURE SELECTION AND MODELLING METHOD FOR MALICIOUS CODE

作　　者：李盟[1,2] 贾晓启[1] 王蕊[1] 林东岱[1] 

机构地区：[1]中国科学院信息工程研究所信息安全国家重点实验室,北京100093 [2]中国科学院大学,北京100049

出　　处：《计算机应用与软件》2015年第8期266-271,共6页Computer Applications and Software

基　　金：国家自然科学基金项目(61100228);中国科学院战略性先导专项项目(XDA06030601;XDA06010701);国家高技术研究发展计划项目(2012AA013101)

摘　　要：针对恶意代码分析检测中静态分析技术难以检测变形、多态代码的问题,提出一种提取恶意代码语义动态特征的方法。该方法在虚拟环境下提取恶意代码动态特征,从而达到保护物理机的目的,提取出的原始特征经过进一步的筛选处理,得到各个代码样本的API调用序列信息。为了使得特征更加有效,改进传统n-gram模型,添加n-gram频次信息以及各API间的依赖关系,构建改进的n-gram模型。实验结果分析部分采用机器学习方法,分别使用了决策树、K近邻、支持向量机、贝叶斯网络等分类器对选定的样本特征进行10折交叉验证。实验结果显示该特征选取在决策树J48下的检测效果最好,可以有效检测采用混淆、多态技术的恶意代码。In malicious code analysis and detection,the static analysis techniques are not effective to detect metamorphic / polymorphic malicious codes. Aiming at this problem,this paper proposes an approach for extracting the dynamic features of malicious code semantics. The method extracts the dynamic features of malicious codes in virtual environment so as to achieve the purpose of protecting physical machine.The primitive features extracted are then further sifted and processed to obtain API calling sequence information in regard to various code samples. In order to make the features more effective,the traditional n-gram model is improved and the n-gram frequency information and the dependencies between APIs are added,the improved n-gram model is built as well. The analysis part in experimental result uses the machine learning methods,the decision trees,k-nearest neighbour,support vector machine and Bayesian networks are employed separately to perform a 10-fold crossover validation on the selected sample features. Experimental results show that this feature selection has best detection effect using decision tree J48,it can effectively detect the malicious codes using confusion and polymorphism technologies.

关 键 词：恶意代码 动态分析 序列特征 机器学习 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]