Malware variants detection based on ensemble learning  

作　　者：Ma Yan Du Donggao 

机构地区：[1]Network and Information Center,Institute of Network Technology,Beijing University of Posts and Telecommunications,Beijing 100876,China [2]National Engineering Laboratory for Mobile Network Security,Beijing University of Post and Telecommunications,Beijing 100876,China

出　　处：《The Journal of China Universities of Posts and Telecommunications》2020年第2期82-90,共9页中国邮电高校学报（英文版）

基　　金：supported by National Natural Science Foundation of China(61601041);Fundamental Research Funds for the Central Universities(2018RC55);Beijing Talents Foundation(2017000020124G062)。

摘　　要：Application programming interface(API)is a procedure call interface to operation system resource.API-based behavior features can capture the malicious behaviors of malware variants.However,existing malware detection approaches have a deal of complex operations on constructing and matching.Furthermore,graph matching is adopted in many approaches,which is a nondeterministic polynominal(NP)-complete problem because of computational complexity.To address these problems,a novel approach is proposed to detect malware variants.Firstly,the API of the malware are divided by their functions and parameters.Then,the classified behavior graph(CBG)is constructed from the API call sequences.Finally,the signature based on CBGs for each malware family is generated.Besides,the malware variants are classified by ensemble learning algorithm.Experiments on 1220 malware samples show that the true positive rate(TPR)is up to 89.0%with the low false positive rate(FPR)3.7%by ensemble learning.

关 键 词：classified behavior malware variant ensemble learning 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论] TP309[自动化与计算机技术—计算机科学与技术]