基于高斯混合模型的增量聚类方法识别恶意软件家族  

Incremental clustering method based on Gaussian mixture model to identify malware family

作　　者：胡建伟 车欣 周漫 崔艳鹏 HU Jianwei;CHE Xin;ZHOU Man;CUI Yanpeng(School of Network and Information Security,Xidian University,Xi’an 710071,China;Institute of Cyberspace Security,Huazhong University of Science and Technology,Wuhan 430074,China)

机构地区：[1]西安电子科技大学网络与信息安全学院,陕西西安710071 [2]华中科技大学网络空间安全学院,湖北武汉430074

出　　处：《通信学报》2019年第6期148-159,共12页Journal on Communications

基　　金：国家自然科学基金资助项目(No.61272033)~~

摘　　要：针对属于同一个家族的恶意软件的行为特征具有逻辑相似性这一特点,从行为检测的角度通过追踪API函数调用的逻辑规则来提取恶意软件的特征,并利用静态分析与动态分析相结合的方法来分析恶意行为特征。此外,依据恶意软件家族的目的性、继承性与多样性,构建了恶意软件家族的传递闭包关系,并改进了基于高斯混合模型的增量聚类方法来识别恶意软件家族。实验证明,所提方法不仅能节省恶意软件检测的存储空间,还能显著提高检测的准确率与识别率。Aiming at the logical similarity of the behavioral characteristics of malware belonging to the same family,the characteristics of malware were extracted by tracking the logic rules of API function call from the perspective of behavior detection,and the static analysis and dynamic analysis methods were combined to analyze malicious behavior characteristics.In addition,according to the purpose,inheritance and diversity of the malware family,the transitive closure relationship of the malware family was constructed,and then the incremental clustering method based on Gaussian mixture model was improved to identify the malware family.Experiments show that the proposed method can not only save the storage space of malware detection,but also significantly improve the detection accuracy and recognition efficiency.

关 键 词：恶意软件家族 高斯混合模型 增量聚类 API函数调用 逻辑规则 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]