基于N-gram算法的恶意程序检测系统研究与设计  

Research and Design on Malware Detection System Based on N-gram Algorithm

作　　者：张家旺[1] 李燕伟[1] 

机构地区：[1]国家计算机网络应急技术处理协调中心,北京100029

出　　处：《信息网络安全》2016年第8期74-80,共7页Netinfo Security

基　　金：国家自然科学基金[61402125]

摘　　要：文章针对恶意程序检测中难以检测未知恶意程序等问题,提出了一种提取恶意程序语义特征的方法。该方法使用N-gram算法对提取的Android应用程序的权限和API特征建立语义特征序列,并对特征序列进行筛选处理,获得了更具代表性的行为特征序列。首先,为了增加特征的有效性,经验丰富的恶意程序分析专家为每个Android SDK中的API函数添加相应的权重,并使用出现频次和权重值重新计算N-gram序列中每个元素的特征值,从而构建了改进的N-gram序列模型。然后,使用多种机器学习算法进行分类检测,验证其有效性。实验结果表明,提取的特征及改进的N-gram算法可以有效检测Android平台上的恶意程序。It is difficult to detect malware detection o f unknown m alicious programs, A im ing atsolving this problem , this paper proposes an approach for extracting the dynamic features o f m aliciouscode sem antics. This m ethod extracts the perm issions and API features o f Android application to setup the semantic feature sequence with the A^-gram algorithm. W ith screening o f the feature sequence,the behavior sequence becom es m ore representative. First, in order to increase the effectiveness o fthe characteristics, analysis o f experienced m alware experts for each Android API function in SD Kto add the corresponding w eights, and the use o f frequency and the w eight value o f each elem ent o fthe N-gram sequence characteristics o f re-calculated values in order to build a A^-gram series m odelim proved. Then, using a variety o f m achine learning algorithms for classification and detection, verifyits effectiveness. The experim ental results show that the im proved N-gram algorithm and features inthis paper can effectively detect m alicious programs under Android platform.

关 键 词：机器学习 恶意代码检测 N-GRAM ANDROID应用 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]