Abstract:

Aiming at the problem that the classification accuracy in malware behavior analysis system was low,a malware classification method based on Support Vector Machine (SVM) was proposed. First, the risk behavior library which used software behavior results as characteristics was established manually. Then all of the software behaviors were captured and matched with the risk behavior library, and the matching results were converted to data suitable for SVM training through the conversion algorithm. In the selection of the SVM model, kernel function and parameters (C,g), a method combining the grid search and Genetic Algorithm (GA) was used to search optimization after theoretical analysis. A malware behavior assessment system based on SVM classification model was designed to verify the effectiveness of the proposed malware classification method. The experiments show that the false positive rate and false negative rate of the system were 5.52% and 3.04% respectively. It means that the proposed method outperforms K-Nearest Neighbor (KNN) and Naive Bayes (NB); its performance is at the same level with the BP neural network, however, it has a higer efficiency in training and classification.

Key words: malware, Support Vector Machine (SVM), Genetic Algorithm(GA), behavior evaluation

摘要：

为解决恶意软件行为分析系统中分类准确率较低的问题,提出了一种基于支持向量机(SVM)的恶意软件分类方法。首先人工建立了一个以软件行为结果作为特征的危险行为库;然后捕获软件所有行为,并与危险行为库进行匹配,通过样本转换算法将匹配结果变成适合SVM处理的数据,再利用SVM进行分类。在SVM模型、核函数以及参数对(C,g)的选择方面先进行理论分析确定大致范围,再使用网格搜索和遗传算法(GA)相结合的方式进行寻优。为验证所提恶意软件分类方法的有效性,设计了一个基于SVM模型的恶意软件行为评估系统。实验结果表明,该系统的误报率和漏报率分别为5.52%和3.04%,比K近邻(KNN)、朴素贝叶斯(NB)算法更好,与反向传播(BP)神经网络相当,但比BP神经网络的训练和分类效率更高。

关键词: 恶意软件, 支持向量机, 遗传算法, 行为评估