Genetic boosting classification for malware detection
Genetic boosting classification for malware detection
复制标题
DOI：
10.1109/cec.2016.7743902
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
Alejandro Martín;Héctor D. Menéndez;David Camacho
中科院分区：
文献类型：
--
作者：
Alejandro Martín;Héctor D. Menéndez;David Camacho
在过去的几年里，病毒作者利用了新的混淆技术，目的是阻止恶意软件，以便使反病毒引擎难以检测到它们。扭转这一趋势的策略包括执行潜在的恶意程序并监视它们在运行时执行的操作，即所谓的动态分析。在本文中，我们提出了一种在不使用这种分析的情况下能够达到高准确率的方法。相反，我们使用静态分析方法，这种方法丢弃了那些不能足够确定地进行分类的样本，当然，需要进行动态分析。K-均值聚类算法被用来根据样本的特征将其划分为区域。然后，在遗传算法的指导下，在使用测试数据集评估的每个区域中执行提升过程，该测试数据集丢弃未达到最小精度阈值的那些区域。
In the last few years virus writers have made use of new obfuscation techniques with the aim of hindering malware in order to difficult their detection by Anti-Virus engines. Strategies to reverse this trend involve executing potentially malicious programs and monitor the actions they perform in runtime, what is known as dynamic analysis. In this paper we present a method able to reach a high accuracy rate without using this kind of analysis. Instead we use a static analysis approach, which discards those samples that cannot be classified with enough certainty and need, certainly, a dynamic analysis. The K-means clustering algorithm has been used to group samples into regions according to their features. Then a boosting process, guided by a genetic algorithm, is executed in each region that are evaluated using a test dataset discarding those regions which do not reach a minimum accuracy threshold.