SGLBRA:一种基于API的恶意软件基因库构建识别方法  

SGLBRA:A Method Based on API for Constructing and Identifying Malware Gene Library

作　　者：王洋 乔亚明 薛飞 贺鹏 WANG Yang;QIAO Yaming;XUE Fei;HE Peng(Xi’an Division of Surveying and Mapping;Xi’an 710054,China, Unit 32065,Shenyang 110000,China)

机构地区：[1]西安测绘总站,陕西西安710054 [2]32065部队,辽宁沈阳110000

出　　处：《信息工程大学学报》2018年第5期586-591,共6页Journal of Information Engineering University

基　　金：国家自然科学基金资助项目(61472447)

摘　　要：受现代生物基因启发,SGLBRA将软件行为特征与生物基因对应,提出一种基于API的软件基因库构建识别方法。该方法摒弃了传统特征检测对二进制码匹配的检测方法,通过获得的软件DNA序列,结合BM算法优化ODN序列比对,利用gene-prefixspan算法对DNA序列进行频繁模式挖掘,分别获得不同种类且带有行为信息的软件基因并以此构建软件基因库gene-trie。通过基因比对算法提取样本的软件基因,并利用随机森林检测SGLBRA模型的准确性。实验表明该模型有较强的泛化能力,能够有效识别实验室现有恶意软件的变种测试集。In this paper, inspired by the modern biological gene, the author proposes SGLBRA by corresponding the behavior characteristics of software to the biological gene: a method to construct software gene bank based on API. The DNA sequences of software gotten by authors, combined with BM algorithm, are used to optimize ODN sequences comparison. It also mines the frequent pattern of DNA sequences and uses Gene-Prefixspan algorithm to access different types of software gene with behavioral information respectively, and Gene-Trie, the gene library of software, is thus constructed. The software gene of samples is extracted by using gene comparison algorithm, and the accuracy of SGLBRA model is detected by using random forest. Experiment shows that the model has strong generalization ability, and can identify the current malware variants test set in laboratory.

关 键 词：软件基因 gene-prefixspan gene-trie 基因比对算法 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]