关键词: 恶意代码检测, 迷惑恶意代码, 特征选择, 层次方法, 代码家族

Abstract: Obfuscated malicious codes can easily escape from being detected by the conventional static method. On the other hand, despite its high detection accuracy, the dynamic method usually expends a large amount of system resources. A hierarchical feature selection method was proposed to improve the detection accuracy with relative low system overhead, where the features were generated and subsequently selected on the oriented layer, the individual layer, the family layer and the global layer, respectively. By the layer-by-layer refinements, an appropriate trade-off between the feature redundancy and information omission was archived using the hierarchical feature selection method. The experimental results on the real-world datasets demonstrate that the proposed method yields high accuracy for detecting obfuscated malicious code, while has several advantages such as smaller size of required training samples and better generalization ability compared with the conventional feature selection methods.

Key words: malicious code detection, obfuscated malicious code, feature selection, hierarchical method, code family