基于机器学习的Windows恶意软件分析与检测关键技术研究

机器学习技术的发展，为恶意软件的准确检测提供了一条非常具有发展前景的途径。然而，多态及变形等技术的流行极大地挑战了基于此类技术的静态检测效果。同时，动态检测方案需要大量的时间开销，无法解决检测的实时性问题。为此，本项目拟以恶意软件的动、静态特征为基础，通过将机器学习与特征工程等技术应用于Windows恶意软件检测领域，注重兼顾检测模型的复杂度、可解释性、精度及时间效率等设计需求，形成一套动、静态检测的集成方案。重点研究：(1)基于恶意软件检测动、静态特征提取的特征目录构建；(2)基于特征工程技术的特征预处理、特征选择与降维；(3)基于具有模型可解释特性的树结构算法的动、静态检测集成方案的分析、实现及检测效果评价等内容。本项目的实施将推动恶意软件检测朝着更加实用化的方向发展，使理论成果更好地满足实际应用需求。

The development of machine learning technology provides a very promising way for the malware detection system to accurately detect malware. However, the popularity of technologies such as polymorphism and metamorphic has challenged the effectiveness of static malware detection. Meanwhile, dynamic detection is costly and cannot solve the real-time detection problem. Therefore, based on the dynamic and static features of malware, this project intends to apply machine learning and feature engineering technology to the field of Windows malware detection, and to pay attention to the complexity, interpretability, accuracy, and time efficiency of the detection model, to build a dynamic and static integration detection scheme. The key research of this project will focus on (1) The construction of feature directory based on the dynamic and static feature extraction; (2) Feature engineering technology-based feature preprocessing, feature selection, and dimension reduction; (3) Analysis, implementation, and evaluation of the detection effect of the dynamic and static detection integration scheme based on tree structure algorithms with model interpretable characteristics. The implementation of this project will promote the development of malware detection in a more practical direction so that the theoretical results can better meet the needs of practical applications.