论文部分内容阅读
提出了一个基于带有惩罚因子的阴性选择算法的恶意程序检测模型.该模型从指令频率和包含相应指令的文件频率两个角度出发,对指令进行了深入的趋向性分析,提取出了趋向于代表恶意程序的恶意程序指令库.利用这些指令,有序切分程序比特串,模型提取得到恶意程序候选特征库和合法程序类恶意程序特征库.在此基础上,文中提出了一种带有惩罚因子的阴性选择算法(negative selection algorithm with penalty factor,NSAPF),根据“异体”和“自体”的匹配情况,采用惩罚的方式,对恶意程序候选特征进行划分,组成了恶意程序检测特征库1(malware detection signature library 1,MDSL1)和恶意程序检测特征库2(MDSL2),以此作为检测可疑程序的二维参照物.综合可疑程序和MDSL1,MDSL2的匹配值,文中模型将可疑程序分类到合法程序和恶意程序.通过在阴性选择算法中引入惩罚因子C,摆脱了传统阴性选择算法中对“自体”和“异体”有害性定义的缺陷,继而关注程序代码本身的危险性,充分挖掘和调节了特征的表征性,既提高了模型的检测效果,又使模型可以满足用户对识别率和虚警率的不同要求.综合实验结果表明,模型在保持较低虚警率的前提下,对完全未知的恶意程序具有较高的识别率,泛化能力较强.通过调整惩罚因子C,模型可以权衡并调整识别率和虚警率,从而取得更好的检测效果.
A malicious program detection model based on the negative selection algorithm with penalty factor is proposed.From the point of view of the instruction frequency and the frequency of the file containing the corresponding instruction, the model analyzes the instruction deeply and extracts the trend of Malicious programs on behalf of the malicious program instruction library.Using these instructions, the order of the program bit sequence segmentation, the model was extracted malicious program feature library and malicious programs feature program base.On this basis, the paper proposed a Negative selection algorithm with penalty factor (NSAPF), based on the matching between “foreign ” and “autonomy ”, uses the penalty method to classify the malicious program candidate features and forms a malicious program The malware detection signature library 1 (MDSL1) and the malware detection signature database 2 (MDSL2) are used as two-dimensional reference objects for detecting suspicious programs.Combining the matching values of the suspect programs with MDSL1 and MDSL2, Suspicious programs are classified as legitimate programs and malicious programs, getting rid of the traditional negative selection by introducing a penalty factor C in the negative selection algorithm Then we pay close attention to the danger of the program code itself, fully excavate and adjust the characterization of the feature, which not only improves the detection effect of the model, but also makes the model Which can meet the different requirements of users on the recognition rate and false alarm rate.The experimental results show that the model has higher recognition rate and better generalization ability than the completely unknown malicious program while keeping the false alarm rate low. By adjusting the penalty factor C, the model can weigh and adjust the recognition rate and false alarm rate so as to achieve better detection results.