基于AdaBoost算法的Linux病毒检测研究  

Linux Virus Detection Study Based on AdaBoost Algorithm

作　　者：吴恋[1,2] 马敏耀[1,2] 黄一峰 赵勇[4] WU Lian1a,1b ,MA Minyao1a,1b, HUANG Yifeng2 ,ZHAO Yong3(la. Department of Mathematics and Computer Science;lb. Big Data Science and Intelligent Engineering Research Institute, Guizhou Education University, Guiyang 550018, China;2. Next Generation Mobile Communication Terminal Laboratory, Chongqing University of Posts and Telecommunications, Chongqing 400065, China;3. School of Electronic and Computer Engineering, Peking University Shenzhen Graduate School, Shenzhen 518055, Chin)

机构地区：[1]贵州师范学院数学与计算机科学学院,贵阳550018 [2]贵州师范学院大数据科学与智能工程研究院,贵阳550018 [3]重庆邮电大学新一代宽带移动通信终端研究所,重庆400065 [4]北京大学深圳研究生院信息工程学院,深圳518055

出　　处：《计算机工程》2018年第8期161-166,173,共7页Computer Engineering

基　　金：贵州省教育厅自然科学研究项目(青年项目)(黔教合KY字【2015】425);贵州省省级重点支持学科"计算机应用技术"(黔学位合字ZDXK【2016】20号);贵州省科技平台及人才团队专项资金(黔科合平台人才【2016】5609);贵州省科学技术基金(黔科合基础【2016】1115)

摘　　要：根据机器学习中分类和集成学习理论,设计一种高性能的Linux病毒检测方法。通过训练得到若干基分类器,然后将基分类器的分类结果进行整合,以获得最终检测结果。该方法以ELF文件特征为样本特征、BP神经网络为基分类器,用AdaBoost算法进行基分类器的训练和整合。对AdaBoost算法的基分类器权重计算及基分类器整合部分进行改进,使之更适用于病毒检测问题。实验结果表明,该方法的病毒检测效果优于Avria Linux和FPROT方法。A high-performance Linux virus detection method is designed using the theory of classification and integration learning in machine learning. This method is,first to train and obtain a number of base classifiers,then to integrate the base classifiers ＇classification results to get the final detection result. The method extracts the ELF file feature as the sample feature,and selects BP neural networks as the base classifiers,and uses the improved AdaBoost algorithm to train and integrate the base classifiers. In the Adaboost algorithm,the weight calculation method and integration method of the base classifiers are improved,which makes this algorithm more suitable for the virus detection problem. Experimental results show that the effectiveness of the proposed detection method is verified by relative experiments,which is better than Avria Linux and F-PROT methods.

关 键 词：病毒检测 ADABOOST算法 BP神经网络 ELF文件特征 D-S证据理论 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]