Malware detection approach based on improved SOINN

Bin ZHANG; Lixun LI; Shuqin DONG

doi:10.11959/j.issn.2096-109x.2019059

您当前的位置：

首页 >

文章列表页 >

Malware detection approach based on improved SOINN

Papers | 更新时间：2024-06-03

- Malware detection approach based on improved SOINN
- Chinese Journal of Network and Information Security Vol. 5, Issue 6, Pages: 21-30(2019)
- 作者机构：
  
  1. 信息工程大学，河南郑州 450001
  2. 河南省信息安全重点实验室，河南郑州 450001
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2019059
  CLC： TP393.08
- Online First：2019-12，
  
  Published：15 December 2019
- 稿件说明：
移动端阅览
Bin ZHANG, Lixun LI, Shuqin DONG. Malware detection approach based on improved SOINN[J]. Chinese Journal of Network and Information Security, 2019, 5(6): 21-30.
DOI：

Bin ZHANG, Lixun LI, Shuqin DONG. Malware detection approach based on improved SOINN[J]. Chinese Journal of Network and Information Security, 2019, 5(6): 21-30. DOI： 10.11959/j.issn.2096-109x.2019059.

摘要

针对基于批量学习的恶意软件检测方法存在检测模型动态更新困难、运算存储开销大的问题，将改进的SOINN算法与有监督分类器有机结合，利用SOINN算法的增量学习特性赋予恶意软件检测模型动态更新能力，有效降低运算存储开销。首先对SOINN算法进行改进：在SOINN算法竞争学习周期内，根据全排列思想搜索所有样本输入次序下神经元的权重调节量，计算所有权重调节量的平均值作为神经元最终权重调节量，避免不同样本输入次序影响训练所得神经网络的稳定性，使所得神经网络更能反映原始数据本质特征，从而提高神经网络针对恶意软件检测的精度。然后采用非负矩阵分解和 Z-score 归一化对数据进行预处理，将恶意软件行为特征向量从高维高数量级转换至低维低数量级，在提高检测速度的同时有效降低高数量级维度对特征学习的不利影响，进一步提高检测准确性。实验结果表明，所提方法支持检测模型动态更新，对未知新样本的检测准确率显著高于传统检测方法，且运算存储开销更小。

Abstract

To deal with the problems of dynamic update of detection model and high computation costs in malware detection model based on batch learning

a novel malware detection approach is proposed by combing SOINN and supervised classifiers

to reduce computation costs and enable the detection model to update dynamically with the assistance of SOINN′s incremental learning characteristic.Firstly

the improved SOINN was given.According to the whole alignment algorithm

search the adjusted weights of neurons under all input sequences in the learning cycle and then calculate the average value of all adjusted weights as the final result

to avoid SOINN′s stability under different input sequences and representativeness of original data

therefore improve malware detection accuracy.Then a data preprocessing algorithm was proposed based on nonnegative matrix factor and Z-score normalization to transfer the malware behavior feature vector from high dimension and high order to low dimension and low order

to speed up and avoid overfitting and further improve detection accuracy.The results of experiments show that proposed approach supports dynamic updating of detection model and has a significantly higher accuracy of detecting unknown new samples and lower computation costs than tradition methods.

关键词

Keywords

references

刘剑 , 苏璞睿 , 杨珉 , 等 . 软件与网络安全研究综述 [J ] . 软件学报 , 2018 ( 1 ): 42 - 68 .

LIU J , SU P R , YANG M , et al . Software and cyber security—a survey [J ] . Journal of Software , 2018 ( 1 ): 42 - 68 .

SONG F , TOUILI T . Efficient malware detection using model-checking [C ] // FM:Formal Methods . 2012 : 418 - 433 .

YIN H , SONG D . Privacy-breaching behavior analysis [M ] . Automatic Malware Analysis . 2013 ： 27 - 42 .

TODERICI A H , STAMP M . Chi-squared distance and metamorphic virus detection [J ] . Journal in Computer Virology , 2013 , 9 ( 1 ): 1 - 14 .

EGELE M , SCHOLTE T , KIRDA E , et al . A survey on automated dynamic malware-analysis techniques and tools [J ] . ACM Computing Surveys , 2008 , 44 ( 2 ): 1 - 42 .

陈志锋 , 李清宝 , 张平 , 等 . 基于聚类分析的内核恶意软件特征选择 [J ] . 电子与信息学报 , 2015 , 37 ( 12 ): 2821 - 2829 .

CHEN Z F , LI Q B , ZHANG P , et al . Signature selection for kernel malware based on cluster analysis [J ] . Journal of Electronics ＆ Information Technology , 2015 , 37 ( 12 ): 2821 - 2829 .

李珍 , 田俊峰 , 杨晓晖 . 基于系统调用属性的程序行为监控 [J ] . 计算机研究与发展 , 2012 , 49 ( 8 ): 1676 - 1684 .

LI Z , TIAN J F , YANG X H . Program behavior monitoring based on system call attributes [J ] . Journal of Computer Research and Development , 2012 , 49 ( 8 ): 1676 - 1684 .

田新广 , 段洣毅 , 程学旗 . 基于 shell 命令和多重行为模式挖掘的用户伪装攻击检测 [J ] . 计算机学报 , 2010 , 33 ( 4 ): 697 - 705 .

TIAN X G , DUAN M Y , CHENG X Q . Masquerade detection based on shell commands and multiple behavior pattern mining [J ] . Chinese Journal of Computers , 2010 , 33 ( 4 ): 697 - 705 .

陈志锋 , 李清宝 , 张平 , 等 . 基于数据特征的内核恶意软件检测 [J ] . 软件学报 , 2016 , 27 ( 12 ): 3172 - 3191 .

CHEN Z F , LI Q B , ZHANG P , et al . Data characteristics-based kernel malware detection [J ] . Journal of Software , 2016 , 27 ( 12 ): 3172 - 3191 .

GREENGARD S . Cyber security gets smart [J ] . Communications of the ACM , 2016 , 59 ( 5 ): 29 - 31

SADEGHI A , BAGHERI H , GARCIA J . A taxonomy and qualitative comparison of program analysis techniques for security assessment of android software [J ] . IEEE Transactions on Software Engineering , 2016 .

杨雅辉 , 黄海珍 , 沈晴霓 , 等 . 基于增量式GHSOM神经网络模型的入侵检测研究 [J ] . 计算机学报 , 2014 ( 5 ): 1216 - 1224 .

YANG Y H , HUANG H Z , SHEN Q N , et al . Research on intrusion detection based on incremental GHSOM [J ] . Chinese Journal of Computers , 2014 ( 5 ): 1216 - 1224 .

邱天宇 , 申富饶 , 赵金熙 . 自组织增量学习神经网络综述 [J ] . 软件学报 , 2016 , 27 ( 9 ): 2230 - 2247 .

QIU T Y , SHEN F R , ZHAO J X . Review of self-organizing incremental neural network [J ] . Journal of Software , 2016 , 27 ( 9 ): 2230 - 2247 .

LEE D D , SEUNG H S . Learning the parts of objects by non-negative matrix factorization [J ] . Nature , 1999 , 401 ( 6755 ): 788 - 791 .

WANG W , ZHANG X , GOMBAULT S , et al . Attribute normalization in network intrusion detection [C ] // International Symposium on Pervasive Systems,Algorithms,and Networks . 2010 : 448 - 453 .

Views

691

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Application research of sample data generation based on improved Cycle-GAN in intrusion detection

Research on intrusion detection model based on synchronization of heterogenous executer

Adversarial method for malicious ELF file detection based on deep reinforcement learning

Multi-feature fusion malware detection method based on attention and gating mechanisms

Related Author

HUANG Kai

JIANG Libing

JIANG Yuchang

GUO Hangkai

ZENG Qingpeng

ZHU Zhengbin

Yu Hong

WEI Shuai

Related Institution

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

School of Mathematics and Computer Sciences, Nanchang University

Songshan Laboratory

Information Engineering University

College of Computer Science, Sichuan University

⁰