Malware prediction technique based on program gene

Da XIAO; Bohan LIU; Baojiang CUI; Xiaochen WANG; Suoxing ZHANG

doi:10.11959/j.issn.2096-109x.2018069

您当前的位置：

首页 >

文章列表页 >

Malware prediction technique based on program gene

Papers | 更新时间：2024-06-03

- Malware prediction technique based on program gene
- Chinese Journal of Network and Information Security Vol. 4, Issue 8, Pages: 21-30(2018)
- 作者机构：
  
  1. 北京邮电大学网络空间安全学院，北京 100876
  2. 移动互联网安全技术国家工程实验室，北京 100876
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2018069
  CLC： TP309.5
- Online First：2018-08，
  
  Published：15 August 2018
- 稿件说明：
移动端阅览
Da XIAO, Bohan LIU, Baojiang CUI, et al. Malware prediction technique based on program gene[J]. Chinese Journal of Network and Information Security, 2018, 4(8): 21-30.
DOI：

Da XIAO, Bohan LIU, Baojiang CUI, et al. Malware prediction technique based on program gene[J]. Chinese Journal of Network and Information Security, 2018, 4(8): 21-30. DOI： 10.11959/j.issn.2096-109x.2018069.

摘要

随着互联网技术日益成熟，恶意程序呈现出爆发式增长趋势。面对无源码恶意性未知的可执行文件，当前主流恶意程序检测多采用基于相似性的特征检测，缺少对恶意性来源的分析。基于该现状，定义了程序基因概念，设计并实现了通用的程序基因提取方案，提出了基于程序基因的恶意程序预测方法，通过机器学习及深度学习技术，使预测系统具有良好的预测能力，其中深度学习模型准确率达到了99.3%，验证了程序基因理论在恶意程序分析领域的作用。

Abstract

With the development of Internet technology

malicious programs have risen explosively.In the face of executable files without source

the current mainstream malware detection uses feature detection based on similarity

with lack of analysis of malicious sources.To resolve this status

the definition of program gene was raised

a generic method of extracting program gene was designed

and a malicious program prediction method was proposed based on program gene.Utilizing machine learning and deep-learning algorithms

the forecasting system has good prediction ability

with the accuracy rate of 99.3% in the deep-learning model

which validates the role of program gene theory in the field of malicious program analysis.

关键词

Keywords

references

2017 年度互联网安全报告 [EB/OL ] . https://slab.qq.com/news/authority/1708.html https://slab.qq.com/news/authority/1708.html .

2017 Internet security report [EB/OL ] . https://slab.qq.com/news/authority/1708.html https://slab.qq.com/news/authority/1708.html .

阮斌 . 《2017年中国网络安全报告》发布 [J ] . 计算机与网络 , 2018 ( 5 ).

RUAN B . 2017 China cyber security report released [J ] . Computer＆ Network , 2018 ( 5 ).

SANTOS I , BREZO F , NIEVES J , et al . Idea:opcode- sequence-based malware detection [C ] // International Conference on Engineering Secure Software and Systems . Springer-Verlag , 2010 : 35 - 43 .

孙博文 , 黄炎裔 , 温俏琨 , 等 . 基于静态多特征融合的恶意软件分类方法 [J ] . 网络与信息安全学报 , 2017 , 3 ( 11 ): 68 - 76 .

SUN B W , HUANG Y Y , WEN Q K , et al . Malware classification method based on static multiple-feature fusion [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 11 ): 68 - 76 .

白金荣 , 王俊峰 , 赵宗渠 . 基于 PE 静态结构特征的恶意软件检测方法 [J ] . 计算机科学 , 2013 , 40 ( 01 ): 122 - 126 .

BAI J R , WANG J F , ZHAO Z Q . Malware detection approach based on structural feature of PE file [J ] . Computer Science , 2013 , 40 ( 01 ): 122 - 126 .

QEMU [EB/OL ] . https://wiki.qemu.org/Main_Page https://wiki.qemu.org/Main_Page .

Pin-a dynamic binary instrumentation tool [EB/OL ] . https:// software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool https:// software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool .

曹梦晨 . 基于沙箱指令流快照的恶意程序智能识别技术研究 [D ] . 北京邮电大学 , 2017 .

CAO M C , . Research on malware intelligent recognition technology based on sandbox instruction flow snapshot [D ] // Beijing University of Posts and Telecommunications , 2017 .

LI H J , TIEN C W , TIEN C W , et al . AOS:An optimized sandbox method used in behavior-based malware detection [C ] // International Conference on Machine Learning and Cybernetics . IEEE , 2011 : 404 - 409 .

FIRDAUSI I , LIM C , ERWIN A , et al . Analysis of machine learning techniques used in behavior-based malware detection [C ] // Second International Conference on Advances in Computing,Control and Telecommunication Technologies . 2010 : 201 - 203 .

CHAN P P F , HUI L C K , YIU S M . Dynamic software birthmark for java based on heap memory analysis [M ] // Communications and Multimedia Security . Springer Berlin Heidelberg , 2011 : 94 - 107 .

LIU K , ZHENG T , WEI L . A software birthmark based on system call and program data dependence [C ] // Web Information System and Application Conference . IEEE , 2015 : 105 - 110 .

韩金 , 单征 , 赵炳麟 , 等 . 基于软件基因的 Android 恶意软件检测与分类 [J ] . 计算机应用研究 , 2019 ( 6 ).

HAN J , SHAN Z , ZHAO B L , et al . Detection and classification of Android malware based on malware gene [J ] . Application Research of Computers , 2019 ( 6 ).

赵晶玲 , 陈石磊 , 曹梦晨 , 等 . 基于离线汇编指令流分析的恶意程序算法识别技术 [J ] . 清华大学学报(自然科学版) , 2016 ( 5 ): 484 - 492 .

ZHAO J L , CHEN S L , CAO M C , et al . Malware algorithm recognition based on offline instruction-flow analyse [J ] . Journal of Tsinghua University(Science and Technology) , 2016 ( 5 ): 484 - 492 .

陈晨 . 基于操作码行为深度学习的恶意代码检测方法 [D ] . 黑龙江:哈尔滨工业大学 , 2013 .

CHEN C . Malicious code detection based on opcode behavior deep learning [D ] . Heilongjiang:Harbin Institute of Technology , 2013 .

BERRAR D , DUBITZKY W . Information gain [M ] . Springer New York , 2013 .

RONG X . Word2vec parameter learning explained [J ] . Computer Science , 2014 .

MIKOLOV T , CHEN K , CORRADO G , et al . Efficient estimation of word representations in vector space [J ] . Computer Science , 2013 .

MIKOLOV T , SUTSKEVER I , CHEN K , et al . Distributed Representations of Words and Phrases and their Compositionality [J ] . NIPS'13 Proceedings of the 26th International Conference on Neural Information Processing Systems , 2013 . 3111 - 3119 .

周志华 . 机器学习:= Machine learning [M ] . 北京 : 清华大学出版社 , 2016 .

ZHOU Z H . Machine learning [M ] . Beijing : Tsinghua University PressPress , 2016 .

CHUA L O , ROSKA T . CNN paradigm [J ] . IEEE Transactions on Circuits ＆ Systems I Fundamental Theory ＆ Applications , 1993 , 40 ( 3 ): 147 - 156 .

Views

1881

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Survey on malicious code dynamic analysis evasion and anti-evasion techniques

Research on host malcode detection using machine learning

Static-analysis-based event input generation approach for Android application

Toward discovering and exploiting private server-side Web API

Research on multi-dimensional iOS privacy disclosure evaluation model

Related Author

ZHOU Yilin

YANG Xiuzhang

PENG Guojun

WANG Chenyang

Gui-xiang SONG

Gang LIU

Yao ZHANG

Dong ZHANG

Related Institution

Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education

School of Cyber Science and Engineering, Wuhan University

State Key Laboratory of Public Big Data, Guizhou University

School of Computer Science and Technology,Shandong University

Key Laboratory of Cryptologic Technology and Information Security,Ministry of Education,Shandong University

⁰