恶意程序检测关键技术研究  

Research on Key Technology of Malicious Program Detection

作　　者：刘飞飞 Liu Feifei(Shanxi Vocational University of Engineering Science and Technology,Jinzhong Shanxi 030619,China)

机构地区：[1]山西工程科技职业大学,山西晋中030619

出　　处：《山西电子技术》2023年第1期108-110,共3页Shanxi Electronic Technology

摘　　要：对恶意程序的概念及描述方法进行了阐述。以恶意程序检测过程为主线,介绍了数据准备阶段使用的静态分析法和动态分析法的特点;梳理了特征提取过程中n-gram描述法、控制流图和数据流图法及API函数依赖关系法的实施原理;分析了训练机器学习模型时选用单分类器模型和多分类器模型的优势与劣势。最后,探讨了未来恶意程序检测的发展和研究方向。The concept and description method of malicious program are described.Taking malicious program detection process as the main line,this paper introduces the characteristics of static analysis method and dynamic analysis method used in data preparation stage,and summarizes the implementation principles of N-gram description method,control flow graph,data flow graph and API function dependence method in the process of feature extraction.The advantages and disadvantages of single-classifier model and multi-classifier model in machine learning model training are analyzed.Finally,the development and research direction of malware detection in the future are discussed.

关 键 词：恶意程序检测 动态分析 特征提取 机器学习 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]