基于数据挖掘的恶意代码检测综述  

Review of Malware Detection Based on Data Mining

作　　者：黄海新[1,2] 张路[1,3] 邓丽[1] 

机构地区：[1]沈阳理工大学信息科学与工程学院,沈阳110159 [2]中国科学院沈阳自动化研究所,沈阳110016 [3]安天实验室,武汉430074

出　　处：《计算机科学》2016年第7期13-18,56,共7页Computer Science

基　　金：国家自然科学基金(61233007)资助

摘　　要：数据挖掘是一种基于统计学的自动发掘数据规律的方法,它能通过分析海量样本的统计规律来建立判别模型,从而让攻击者难以掌握免杀的规律,近年来得到了广泛关注和快速发展。综述了数据挖掘技术应用于恶意代码检测领域所取得的研究成果;对所涉及的特征提取、特征选择、分类模型及其性能评估方法等方面的研究成果进行了深入分析和比较;最后提出了基于数据挖掘的恶意代码检测所面临的挑战,并对研究方向进行了展望。Data mining is a method for automatically discovering data rule based on statistics which can analyze huge amounts of sample statistics to establish discriminative model, so that an attacker can not master the law to avoid detec- tion. It has attracted widespread interests and has developed rapidly in recent years. In this paper, the research on malware detection based on data mining was summarized. The research results on feature extraction, feature selection, clas-sification model and its performance evaluation methods were analyzed and compared in detail. At last, the challenges and prospect were provided in the field.

关 键 词：数据挖掘 机器学习 恶意代码检测 特征提取 特征选择 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]