基于聚类分析的内核恶意软件特征选择  

Signature Selection for Kernel Malware Based on Cluster Analysis

作　　者：陈志锋[1,2] 李清宝[1,2] 张平[1,2] 冯培钧 

机构地区：[1]解放军信息工程大学,郑州450001 [2]数学工程与先进计算国家重点实验室,郑州450001

出　　处：《电子与信息学报》2015年第12期2821-2829,共9页Journal of Electronics & Information Technology

基　　金：核高基国家科技重大专项(2013JH00103);国家863计划目标导向项目(2009AA01Z434)~~

摘　　要：针对现有基于数据特征的内核恶意软件检测方法存在随特征的增多效率较低的问题,该文提出一种基于层次聚类的特征选择方法。首先,分析相似度计算方法应用于数据特征相似度计算时存在的困难,提出最长公共子集并设计两轮Hash求解法计算最长公共子集;其次,设计基于最长公共子集的层次聚类算法,有效地将相似特征聚类成簇;在此基础上,设计基于不一致系数的内核恶意软件特征选择算法,大大减少特征数,提高检测效率。实验结果验证了方法的有效性,且时间开销在可接受的范围内。As current kernel malware detection method based on data signature exists the problem that its efficiency decreases with the growth of the number of signatures, a signature selection method for kernel malware based on hierarchical cluster is presented. First, since current similarity calculation methods are difficult to be applied to data signature selection, a longest common subset based method and a 2-round Hash computation algorithm are introduced. Second, a longest common subset based hierarchical cluster algorithm is presented,thereby performing similar signature aggregation effectively. Finally, a signature selection algorithm based on inconsistent coefficient is designed to reduce the number of signatures. Experimental results show the effectiveness of the method, and performance evaluations indicate that algorithm runtime is acceptable.

关 键 词：数据特征 最长公共子集 层次聚类 特征选择 内核恶意软件 

分 类 号：TP316[自动化与计算机技术—计算机软件与理论]