一种基于多图像特征融合和GA-Stacking的恶意代码检测模型  

A Malicious Code Detection Model Based on Multi-Image Feature Fusion and GA-Stacking

作　　者：熊其冰 XIONG Qibing(Dept.of Cyberspace Security,Henan Police College,Zhengzhou Henan 450000,China)

机构地区：[1]河南警察学院网络安全系,河南郑州450000

出　　处：《通信技术》2024年第12期1305-1310,共6页Communications Technology

基　　金：河南省重点研发专项项目(221111321700);河南警察学院院级课题资助项目(HNJY-2024-QN-03);河南省高等学校青年骨干教师培养计划(2024GGJS147)。

摘　　要：随着互联网技术的不断进步,应用程序数量呈现出高速增长的态势,同时恶意软件的数量和种类不断增长,加剧了网络空间安全风险。基于多图像特征融合和GA-Stacking的恶意代码检测模型选取图像全局图像结构张量(Global Image Structure Tensor,GIST)特征、图像方向梯度直方图(Histogram of Oriented Gradient,HOG)特征和图像灰度共生矩阵(Gray Level Co-occurrence Matrix,GLCM)特征等表征恶意代码,采用遗传算法(Genetic Algorithm,GA)和Stacking策略对支持向量机(Support Vector Machine,SVM)、K近邻(K Nearest Neighbors,KNN)、随机森林(Random Forest,RF)等基分类器进行两阶段递进优化,以增强模型的检测性能。在恶意代码数据集DataCon2020上的实验结果显示,该模型检测准确率达到98.13%,F1值达到97.13%,相较于对比模型,均有明显提升。With the continuous progress of Internet technology,the number of applications shows a trend of rapid growth.At the same time,the number and types of malware continue to increase,exacerbating the security risks in cyberspace.The malicious code detection model based on multi-image feature fusion and GA Stacking selects GIST(Global Image Structure Tensor)feature,HOG(Histogram of Oriented Gradient)feature and GLCM(Gray Level Co-occurrence Matrix)feature to represent malicious code,and employs GA(Genetic Algorithm)and Stacking strategy to perform a two-stage progressive optimization for base classifiers such as SVM(Support Vector Machine),KNN(K Nearest Neighbors)and RF(Random Forest)to enhance model detection performance.The experimental results on the malicious code dataset DataCon2020 indicate that the model achieves a detection accuracy of 98.13%and an F1 score of 97.13%,both of which are significantly improved compared to the comparative model.

关 键 词：图像特征 遗传算法 Stacking集成 恶意代码检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]