Abstract: The existing methods of malware feature selection and reduction methods were studied. Current attribute reduction methods of malware do not take advantage of the information of feature selection evaluation function. So a method was proposed to order all features based on their value of information gain and their size, and used attributes order reduction method to get a reduction. An analysis of spatial and temporal complexity was given, and the overall design was given. Test results show that the application of attributes order reduction can obtain fewer reduction results in less time, and get higher classification accuracy using the reduction result.

Key words: malware, feature selection, reduction, information gain, attribute order

摘要： 研究了已有的恶意代码特征选择和约简方法，针对已有的属性约简方法没有充分利用特征选择评估函数信息的不足，提出以信息增益值和特征的规模对候选特征排序，并使用属性序约简对特征进行约简的方法，分析了时空复杂度,给出了总体设计方案。实验结果验证了属性序约简的应用能够在较短的时间内获得较少的约简结果，使用约简后的特征进行分类准确率较高。

关键词: 恶意代码, 特征选择, 约简, 信息增益, 属性序