摘要
随着互联网技术日益成熟,恶意程序呈现出爆发式增长趋势。面对无源码恶意性未知的可执行文件,当前主流恶意程序检测多采用基于相似性的特征检测,缺少对恶意性来源的分析。基于该现状,定义了程序基因概念,设计并实现了通用的程序基因提取方案,提出了基于程序基因的恶意程序预测方法,通过机器学习及深度学习技术,使预测系统具有良好的预测能力,其中深度学习模型准确率达到了99.3%,验证了程序基因理论在恶意程序分析领域的作用。
With the development of Internet technology, malicious programs have risen explosively. In the face of executable files without source, the current mainstream malware detection uses feature detection based on similarity, with lack of analysis of malicious sources. To resolve this status, the definition of program gene was raised, a gener-ic method of extracting program gene was designed, and a malicious program prediction method was proposed based on program gene. Utilizing machine learning and deep-learning algorithms, the forecasting system has good prediction ability, with the accuracy rate of 99.3% in the deep-learning model, which validates the role of program gene theory in the field of malicious program analysis.
作者
肖达
刘博寒
崔宝江
王晓晨
张索星
XIAO Da;LIU Bohan;CUI Baojiang;WANG Xiaochen;ZHANG Suoxing(School of Cyberspace Security,Beijing University of Post and Telecommunications,Beijing 100876,China;National Engineering Lab for Mobile Network Security,Beijing 100876,China)
出处
《网络与信息安全学报》
2018年第8期21-30,共10页
Chinese Journal of Network and Information Security
基金
国家自然科学基金资助项目(No.U1536122
No.61502536)~~
关键词
程序基因
动态分析
基本块
恶意程序预测
program gene
dynamic analysis
basic block
malware prediction
