| 本文已被：浏览 6682次 下载 8869次 |
码上扫一扫！ |
|
|
| 提升多维特征检测迷惑恶意代码 |
|
孔德光1,2, 谭小彬1, 奚宏生1, 宫涛1, 帅建梅1
|
|
1.中国科学技术大学 自动化系,安徽 合肥 230027;2.Cyber-Security Laboratory, The Pennsylvania State University, University Park, State College, 16801, USA
|
|
| 摘要: |
| 针对迷惑恶意代码识别率较低的问题,提出一种基于提升多维特征的迷惑恶意代码检测算法.该算法在对迷惑恶意代码反汇编后进行静态分析,从Opcode 分布序列、调用流图特征、系统调用序列图这3 个特征维度对恶意代码家族特征进行归纳和分析,结合统计和语义结构特征表现恶意代码“行为”特性,从而对分类结果加权投票后给出迷惑恶意代码家族判定信息.实验结果表明,该方法对迷惑恶意代码家族检测准确率较高. |
| 关键词: 恶意代码检测 多维特征 迷惑 提升 |
| DOI：10.3724/SP.J.1001.2011.03727 |
| 分类号: |
| 基金项目:国家高技术研究发展计划(863) (2006AA01Z449) |
|
| Obfuscated Malware Detection Based on Boosting Multilevel Features |
|
KONG De-Guang1,2, TAN Xiao-Bin1, XI Hong-Sheng1, GONG Tao1, SHUAI Jian-Mei1
|
|
1.Department of Automation, University of Science and Technology of China, Hefei 230027, China;2.Cyber-Security Laboratory, The Pennsylvania State University, University Park, State College, 16801, USA
|
| Abstract: |
| To cope with the problem of the low accuracy in detecting obfuscated malware, an algorithm to detect obfuscated malware based on boosting multi-level features is presented. After a disassembly analysis and static analysis for the obfuscated malware, the algorithm extracts features from three dimensions: opcode distribution, a function call graph, and a system call graph, which combines the statistic and semantic features to reflect the behavior characteristic of the malware, and then gives out the decision result based on weighted voting for a different feature analysis. It has been proven by experiment that the algorithms have a much higher accuracy on the testing dataset. |
| Key words: malware detection multi-feature obfuscate boosting |
