基于集成学习的PE恶意代码静态特征检测研究  

PE Malicious Code Static Feature Detection Based on Ensemble Learning

作　　者：李佟鸿[1] 冷静[1] LI Tong-hong;LENG Jing(Hubei University of Police,Wuhan 430032,China)

机构地区：[1]湖北警官学院,武汉430032

出　　处：《湖北第二师范学院学报》2023年第8期37-44,共8页Journal of Hubei University of Education

基　　金：2017年度教育部人文社会科学研究规划基金项目“基于深度学习的恶意代码分类技术研究”(17YJAZH043)。

摘　　要：应用机器学习研究恶意代码的检测和分类问题,是当前网络安全行业的研究热点。通过对PE(可移植可执行)格式的恶意代码文件提取头信息等静态特征,运用可视化分析方法研究恶意代码与良性代码重要特征之间的结构性差异。将机器学习的集成学习思想应用到恶意代码检测,使用几种典型的集成学习模型对特征数据集进行学习,取得了良好的检测效果。设计了一个2层的Stacking组合模型,恶意代码检测达到99.13%的准确率,AUC值99.6%,已几乎接近最优值1。比对实验中采用不同的数据集,验证所使用模型的检测效果。The use of machine learning to study the detection and classification of malicious code is currently a research focus in the field of network security.By extracting static features such as header information from malicious code in PE(Portable and Executable)format,and using visual analysis methods to study the structural differences between important features of malicious code and benign code,the ensemble learning idea of machine learning is applied to malicious code detection.Several typical ensemble learning models are used to learn feature datasets,which achieved good detection results.A two-layer stacking combination model was designed,with an accuracy of 99.13%for malicious code detection,and an AUC value of 99.6%which is almost close to the optimal value of 1.Different datasets were used in the comparative experiment to verify the detection effectiveness of the model used.

关 键 词：集成学习 PE文件 Stacking组合模型 恶意代码 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]