基于特征权重的恶意软件分类方法  

Malware Classification Method Based on Feature Weights

作　　者：叶彪 李琳[1,2] 丁应 宋荆汉 万振华 YE Biao;LI Lin;DING Ying;SONG Jing-han;WAN Zhen-hua(School of Computer Science and Technology,Wuhan University of Science and Technology,Wuhan 430065,China;Hubei Province Key Laboratory of Intelligent Information Processing and Real-time Industrial System,Wuhan 430065,China;Shanghai Aerospace Precision Machinery Research Institute,Shanghai 201600,China;Shenzhen Open Source Internet Security Technology Co.,Ltd.,Shenzhen 518000,China)

机构地区：[1]武汉科技大学计算机科学与技术学院,湖北武汉430065 [2]智能信息处理与实时工业系统湖北省重点实验室,湖北武汉430065 [3]上海航天精密机械研究所,上海201600 [4]深圳开源互联网安全技术有限公司,广东深圳518000

出　　处：《计算机技术与发展》2022年第11期115-120,共6页Computer Technology and Development

基　　金：国家自然科学基金(61572381);湖北省教育厅项目(2020354);湖北省大学生创新创业训练计划项目(S202110488047)。

摘　　要：近年来由于计算机和人们的工作生活结合得更加紧密,为保障信息安全,恶意软件分类的重要性与日俱增,但是现有的恶意软件分类方法大多都存在模型复杂、耗费时间长以及效果不突出等困境。为提高恶意软件分类效率,提出一个结合特征提取和卷积神经网络的恶意软件分类框架。针对目前恶意软件分类算法准确率低、处理时间慢等问题,引入并改进了NLP领域中的一种特征权重算法。通过计算操作码的特征权重,选取具有较大信息增益的操作码作为特征词,然后提取恶意样本的特征图,最后传入卷积神经网络进行训练和分类。实验结果表明,该方法在big2015数据集上的准确率为99.26%,比基于TFIDF特征提取的方法略好,接近该数据集上的冠军方法,在不均衡类别上的分类表现优于基于频率的特征词选择的提取算法,并且在预处理时间上短于其他方法。In recent years,as computers and people’s work and life have become more closely integrated,the importance of malware classification has increased day by day to ensure information security.However,most of the existing malware classification methods have difficulties such as complex model,long time-consuming,and inconspicuous effects.In order to improve the efficiency of malware classification,a malware classification framework combining feature extraction and convolutional neural network is proposed.Aiming at the problems of low accuracy and slow processing time of current malware classification algorithms,a feature weighting algorithm in the field of NLP is introduced and improved.By calculating the feature weight of the opcode,the opcode with greater information gain is selected as the feature words,then the feature maps of the malicious sample is extracted,and passed into the convolutional neural network for training and classification at last.Experimental results show that the accuracy of the proposed method on the big2015 dataset is 99.26%,which is slightly better than the method based on TFIDF feature extraction.It is close to the champion method on this dataset,and the classification performance on unbalanced categories is better than that based on frequency.The extraction algorithm for feature word selection,and the preprocessing time is shorter than other methods.

关 键 词：特征权重 特征提取 操作码 卷积神经网络 恶意软件分类 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]