基于静态多特征融合的恶意软件分类方法

孙博文; 黄炎裔; 温俏琨; 田斌; 吴鹏; 李祺

doi:10.11959/j.issn.2096-109x.2017.00217

您当前的位置：

首页 >

文章列表页 >

基于静态多特征融合的恶意软件分类方法

学术论文 | 更新时间：2024-06-03

- 基于静态多特征融合的恶意软件分类方法
- Malware classification method based on static multiple-feature fusion
- 网络与信息安全学报 2017年3卷第11期页码：68-76
- 作者机构：
  
  1. 北京邮电大学网络空间安全学院天地互联与融合北京市重点实验室，北京 100876
  2. 北京邮电大学国际学院，北京 100876
  3. 中国信息安全测评中心，北京 100085
  4. 四川大学计算机学院，四川成都 610015
- 作者简介：
  
  [ "孙博文（1994-），男，辽宁沈阳人，北京邮电大学硕士生，主要研究方向为网络安全、恶意软件检测。" ]
  [ "黄炎裔（1994-），女，江西黎川人，北京邮电大学硕士生，主要研究方向为数据安全、分布式调度。" ]
  [ "温俏琨（1996-），女，辽宁沈阳人，北京邮电大学本科生，主要研究方向为网络安全、机器学习。" ]
  [ "田斌（1983-），男，北京人，博士，中国信息安全测评中心副研究员，主要研究方向为威胁情报、攻击溯源。" ]
  [ "吴鹏（1982-），男，四川广元人，四川大学博士生，主要研究方向为恶意软件检测、软件抄袭、软件安全加固。" ]
  [ "李祺（1981-），女，北京人，北京邮电大学副教授，主要研究方向为网络安全、机器学习、物联网安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(U1536119);国家自然科学基金资助项目;The National Natural Science Foundation of China(61401038)
- DOI：10.11959/j.issn.2096-109x.2017.00217
  中图分类号： TP309.5
- 网络首发：2017-11，
  
  纸质出版：2017-11-15
- 稿件说明：
移动端阅览
孙博文, 黄炎裔, 温俏琨, 等. 基于静态多特征融合的恶意软件分类方法[J]. 网络与信息安全学报, 2017,3(11):68-76.

Bo-wen SUN, Yan-yi HUANG, Qiao-kun WEN, et al. Malware classification method based on static multiple-feature fusion[J]. Journal of network and information security, 2017, 3(11): 68-76.
孙博文, 黄炎裔, 温俏琨, 等. 基于静态多特征融合的恶意软件分类方法[J]. 网络与信息安全学报, 2017,3(11):68-76. DOI： 10.11959/j.issn.2096-109x.2017.00217.

Bo-wen SUN, Yan-yi HUANG, Qiao-kun WEN, et al. Malware classification method based on static multiple-feature fusion[J]. Journal of network and information security, 2017, 3(11): 68-76. DOI： 10.11959/j.issn.2096-109x.2017.00217.

摘要

近年来，恶意软件呈现出爆发式增长势头，新型恶意样本携带变异性和多态性，通过多态、加壳、混淆等方式规避传统恶意代码检测方法。基于大规模恶意样本，设计了一种安全、高效的恶意软件分类的方法，通过提取可执行文件字节视图、汇编视图、PE 视图3个方面的静态特征，并利用特征融合和分类器集成学习2种方式，提高模型的泛化能力，实现了特征与分类器之间的互补，实验证明，在样本上取得了稳定的F1-score（93.56%）。

Abstract

In recent years

the amount of the malwares has tended to rise explosively.New malicious samples emerge as variability and polymorphism.By means of polymorphism

shelling and confusion

traditional ways of detecting can be avoided.On the basis of massive malicious samples

a safe and efficient method was designed to classify the mal-wares.Extracting three static features including file byte features

assembly features and PE features

as well as im-proving generalization of the model through feature fusion and ensemble learning

which realized the complementarity between the features and the classifier.The experiments show that the sample achieve a stable F1-socre (93.56%).

关键词

Keywords

references

卡巴斯基年报 [EB/OL ] . https://securelist.com/kasperskysecurity-bulletin-2016-story-of-the-year/76757/ https://securelist.com/kasperskysecurity-bulletin-2016-story-of-the-year/76757/ .

Kabasiji annual report [EB/OL ] . https://securelist.com/kasperskysecurity-bulletin-2016-story-of-the-year/76757/ https://securelist.com/kasperskysecurity-bulletin-2016-story-of-the-year/76757/ .

赛门铁克年报 [EB/OL ] . https://www.symantec.com/products/atpcontent-malware-analysis https://www.symantec.com/products/atpcontent-malware-analysis .

Symantec annual report [EB/OL ] . https://www.symantec.com/products/atp-content-malware-analysis https://www.symantec.com/products/atp-content-malware-analysis .

SCHULTZ M G , ESKIN E , ZADOK E , et al . Data mining methods for detection of new malicious executables [C ] // 2001 IEEE Sympo-sium on Security and Privacy(S＆P 2001) , 2001 : 38 - 49 .

MEHDI B , AHMED F , KHAYYAM S A , et al . Towards a Theory of Generalizing System Call Representation for In-Execution Mal-ware Detection [C ] // IEEE International Conference on Communica-tions , 2010 : 1 - 4 .

PARK Y , REEVES D , MULUKUTLA V , et al . Fast malware classi-fication by automated behavioral graph matching [C ] // AMIA Annu Symp Proc , 2010 : 1 - 4 .

SANTOS I , BREZO F , UGARTE-PEDRERO X , et al . Opcode sequences as representation of executables for data-mining-based unknown malware detection [J ] . Information Sciences , 2013 , 231 ( 9 ): 64 - 82 .

GRINI L S , SHALAGINOV A , FRANKE K . Study of soft compu-ting methods for large-scale multinomial malware types and fami-lies de-tection [C ] // The World Conference on Soft Computing , 2016 .

RIECK K , HOLZ T , WILLEMS C , et al . Learning and classifica-tion of malware behavior [C ] // The International Conference on Detection of Intrusions ＆ Malware , 2008 : 108 - 125 .

SALEHI Z , SAMI A , GHIASI M . Using feature generation from API calls for malware detection [J ] . Computer Fraud ＆ Security , 2014 , 2014 ( 9 ): 9 - 18 .

KOLOSNJAJI B , ZARRAS A , WEBSTER G ， et al . Deep learning for classi-fication of malware system call sequences [M ] // AI 2016:Advances in Artificial Intelligence . Berlin ： Springer ， 2016 .

韩晓光，曲武，姚宣霞，等 . 基于纹理指纹的恶意代码变种检测方法研究 [J ] . 通信学报， 2014 , 35 ( 8 ): 125 - 136 .

HAN X G , QU W , YAO X X , et al . Research on malicious code variants detection based on texture fingerprint [J ] . Journal on Communications . 2014 , 35 ( 8 ): 125 - 136 .

Digital bread crumbs:seven clues to identifying who's behind advanced cyber attacks [EB/OL ] . https://www.fire-eye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-digital-bread-crumbs.pdf https://www.fire-eye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-digital-bread-crumbs.pdf .

IDA pro website [EB/OL ] . https://www.hex-rays.com,accessed:27.06.2017 https://www.hex-rays.com,accessed:27.06.2017 .

PE Exeinfo website [EB/OL ] . http://exeinfo.pe.hu/,accessed:12.06.2017 http://exeinfo.pe.hu/,accessed:12.06.2017 .

Mastiff website [EB/OL ] . https://github.com/KoreLogicSecurity/mastiff,accessed:27.06.2017 https://github.com/KoreLogicSecurity/mastiff,accessed:27.06.2017 .

Yara-rules website [EB/OL ] . https://github.com/Yara-Rules/rules https://github.com/Yara-Rules/rules .

Top maliciously used APIs [EB/OL ] . https://www.bnxnet.com/wp-content/uploads/2015/01/malware_APIs.pdf.-- https://www.bnxnet.com/wp-content/uploads/2015/01/malware_APIs.pdf.-- .

Scikit-learn website [EB/OL ] . https://github.com/scikit-learn/sci-kit-learn https://github.com/scikit-learn/sci-kit-learn .

VirusShare website [EB/OL ] . https://virusshare.com/ https://virusshare.com/ .

Naming scheme-caro-computer antivirus research organization [EB/OL ] . www.caro.org/naming/scheme.html www.caro.org/naming/scheme.html .

Free online virus,malware and url scanner [EB/OL ] . https://www.virustotal.com/ https://www.virustotal.com/ .

浏览量

8065

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于机器学习算法的主机恶意代码检测技术研究

DNS异常检测：大规模实验分析

基于代码相似性的软件漏洞检测研究进展

基于扩散模型的机器学习后门攻击防御方法

基于垂直分割的个人数据隐私保护方法