Malware Detection Based on Multidimensional Time Distribution Features  

作　　者：Huizhong Sun Guosheng Xu Hewei Yu Minyan Ma Yanhui Guo Ruijie Quan 

机构地区：[1]School of Cyberspace Security,Beijing University of Posts and Telecommunication,Beijing,China [2]Computer Network Emergency Response Technical Team/Coordination Center of China(CNCERT/CC),Beijing,China [3]Zhejiang Branch of National Computer Network Emergency Response Technical Team/Coordination Center of China,Hangzhou,China [4]Faculty of Engineering and Information Technology,University of Technology Sydney,Sydney,Australia

出　　处：《Journal of Quantum Computing》2021年第2期55-63,共9页量子计算杂志（英文）

基　　金：supported by the National Key Research and Development Program of China(No.2017YFB0801900).

摘　　要：Language detection models based on system calls suffer from certain false negatives and detection blind spots.Hence,the normal behavior sequences of some malware applications for a short period can become malicious behavior within a certain time window.To detect such behaviors,we extract a multidimensional time distribution feature matrix on the basis of statistical analysis.This matrix mainly includes multidimensional time distribution features,multidimensional word pair correlation features,and multidimensional word frequency distribution features.A multidimensional time distribution model based on neural networks is built to detect the overall abnormal behavior within a given time window.Experimental evaluation is conducted using the ADFA-LD dataset.Accuracy,precision,and recall are used as the measurement indicators of the model.An accuracy rate of 95.26%and a recall rate of 96.11%are achieved.

关 键 词：System call SEQUENCE MALWARE neural network 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]