关键词: 计算机病毒, 行为检测, 信息熵, 支持向量机, 多类分类

Abstract: In order to achieve specific functions, computer viruses are of some special behaviors different from those of the normal programs. Appling Support Vector Machine (SVM), the paper created a space of virus API feature vector and amplified the difference between normal programs and computer virus with the help of information entropy. By training a classifier, a hyperplane was found, which could divide the API space into two parts, each of which represented one kind of the programs. Moreover, the paper collected behaviors of different kinds of viruses. Through statistics, analysis and calculation on amount of samples' API calls, the amount and distribution patterns of APIs were exposed. As most viruses' behaviors are finite, the paper set 2100 as the length of API sequence, thus detecting most test viruses. Compared with previous virus detection methods, the proposed method is more practical.

Key words: Computer virus, Behavior-based detection, Information entropy, Support Vector Machine(SVM), Multi-class classification