«上一篇/Previous Article|本期目录/Table of Contents|下一篇/Next Article»

《计算机技术与发展》[ISSN:1006-6977/CN:61-1281/TN]

卷:

32

期数:

2022年11期

页码:

115-120

栏目:

网络空间安全

出版日期:

2022-11-10

文章信息/Info

Title:

Malware Classification Method Based on Feature Weights

文章编号:

1673-629X(2022)11-0115-06

作者:

叶 彪¹; 2 ; 李 琳¹; 2 ; 丁 应³ ; 宋荆汉⁴ ; 万振华⁴

1. 武汉科技大学 计算机科学与技术学院,湖北 武汉 430065;

2. 智能信息处理与实时工业系统湖北省重点实验室,湖北 武汉 430065;

3. 上海航天精密机械研究所,上海 201600;

4. 深圳开源互联网安全技术有限公司,广东 深圳 518000

Author(s):

YE Biao1; 2 ; LI Lin1; 2 ; DING Ying3 ; SONG Jing-han4 ; WAN Zhen-hua4

1. School of Computer Science and Technology,Wuhan University of Science and Technology,Wuhan 430065,China;

2. Hubei Province Key Laboratory of Intelligent Information Processing and Real-time Industrial System,Wuhan 430065,China;

3.?Shanghai Aerospace Precision Machinery Research Institute,Shanghai 201600,China;

4. Shenzhen Open Source Internet Security Technology Co. ,Ltd. ,Shenzhen 518000,China

关键词:

特征权重; 特征提取; 操作码; 卷积神经网络; 恶意软件分类

Keywords:

feature weight; feature extraction; opcode; convolutional neural network; malware classification

分类号:

TP309

DOI:

10. 3969 / j. issn. 1673-629X. 2022. 11. 017

摘要:

近年来由于计算机和人们的工作生活结合得更加紧密,为保障信息安全,恶意软件分类的重要性与日俱增,但是现有的恶意软件分类方法大多都存在模型复杂、耗费时间长以及效果不突出等困境。 为提高恶意软件分类效率,提出一个结合特征提取和卷积神经网络的恶意软件分类框架。 针对目前恶意软件分类算法准确率低、处理时间慢等问题,引入并改进了 NLP 领域中的一种特征权重算法。 通过计算操作码的特征权重,选取具有较大信息增益的操作码作为特征词,然后提取恶意样本的特征图,最后传入卷积神经网络进行训练和分类。 实验结果表明,该方法在 big2015 数据集上的准确率为 99. 26% ,比基于 TFIDF 特征提取的方法略好,接近该数据集上的冠军方法,在不均衡类别上的分类表现优于基于频率的特征词选择的提取算法,并且在预处理时间上短于其他方法。

Abstract:

In recent years,as computers and people’s work and life have become more closely integrated,the importance of malware classification has increased day by day to ensure information security. However,most of the existing malware classification methods have difficulties such as complex model,long time-consuming,and inconspicuous effects. In order to improve the efficiency of malware classification,a malware classification framework combining feature extraction and convolutional neural network is proposed. Aiming at theproblems of low accuracy? ?and slow processing time of current malware classification algorithms,a feature weighting algorithm in the fieldof NLP is introduced and improved. By calculating the feature weight of the opcode,the opcode with greater information gain is selectedas the feature words,then the feature maps of the malicious sample is extracted,and passed into the convolutional neural network fortraining and classification at last. Experimental results show that the accuracy of the proposed method on the big2015 dataset is 99. 26% ,which is slightly better than the method based on TFIDF feature extraction. It is close to the champion method on this dataset,and theclassification performance on unbalanced categories is better than that based on frequency. The extraction algorithm for feature wordselection,and the preprocessing time is shorter than other methods.

常用功能

更新日期/Last Update: 2022-11-10