基于智能分析的恶意软件检测研究进展和挑战  

Research Progress and Challenges of Malware Detection Based on Intelligent Analysis

作　　者：武强 苗彦涛 余尚仁 WU Qiang;MIAO Yantao;YU Shangren(No.30 Institute of CETC,Chengdu Sichuan 610041,China;China Electronic Cyber Security Co.,Ltd.,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041 [2]中国电子科技网络信息安全有限公司,四川成都610041

出　　处：《通信技术》2022年第9期1183-1195,共13页Communications Technology

基　　金：国家科技部重点研发计划(2019YFB2101700)。

摘　　要：在应对恶意软件变种和新增恶意软件时,基于特征匹配等方法的传统恶意软件检测手段往往存在较高的误报率和漏报率。随着人工智能技术的发展,将人工智能应用在恶意软件检测领域具有广阔的发展空间。首先,从数据集构建、安全特征提取、安全特征处理、分类器选择、模型验证和性能评估这5个方面对Windows平台下的恶意软件智能分析相关工作进行了归纳总结;其次,对智能分析在恶意软件检测上所面临的挑战和问题进行了较为细致的阐述;最后,针对所面临的挑战,指出未来潜在的研究方向。In the process of dealing with malware variants and new malware,traditional malware detection techniques based on feature matching and other methods often have high false positive rate and false negative rate.With the development of artificial intelligence technology,its application in the field of malware detection has a broad development space.First,the relevant work of intelligent analysis of malware based on Windows platform is summarized from five aspects:data set construction,security feature extraction,security feature processing,classifier selection,model validation and performance evaluation.Then,the challenges and problems faced by intelligent analysis in malware detection are elaborated.Finally,the potential research directions in the future are pointed out in light of the challenges faced.

关 键 词：WINDOWS平台 恶意软件检测 家族识别 智能分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP311.5[自动化与计算机技术—计算机科学与技术]