基于静态分析的Windows恶意软件检测,具有多个功能
Muhammad Irfan Yousuf1, Izza Anwer2, Ayesha Riasat3
1Department of Computer Science, University of Engineering and Technology Lahore, Lahore, Pakistan.
PeerJ. Computer science
|June 22, 2023
概括
本研究介绍了用于Windows便携式可执行文件 (PE) 的静态恶意软件检测系统. 它使用机器学习和组合技术准确识别恶意软件,达到99.5%的检测率.
科学领域:
- 计算机科学 计算机科学
- 网络安全 网络安全
- 机器学习 机器学习
背景情况:
- 恶意软件对计算机系统和用户构成重大和持续的威胁.
- 现有的恶意软件检测方法经常在准确性和效率方面扎.
- 研究界不断寻求改进强大的恶意软件识别技术.
研究的目的:
- 为Windows便携式可执行文件 (PE) 开发和评估一个高精度的静态恶意软件检测系统.
- 探索各种机器学习和集体学习技术在恶意软件分类中的有效性.
- 通过缩小维度的方法来提高检测性能.
主要方法:
- 创建了27,920个Windows PE恶意软件样本的数据集,从PE标题,PE部分,导入的DLL和API函数中提取特征.
- 应用了七种机器学习模型 (渐变增强,决策树,随机森林,SVM,KNN,天真贝叶斯,最近的中位数) 和三种组合技术 (多数投票,堆泛化,AdaBoost).
- 使用尺寸缩小技术,信息获取和主要组件分析来优化特征集.
主要成果:
- 静态恶意软件检测系统实现了99.5%的高检测率.
- 该系统显示出0.47%的低错误率.
- 与之前的研究相比,实验证实了该系统在原始和减少特征集上的卓越性能和稳定性.
结论:
- 结合机器学习,集合学习和缩小维度的综合方法有效地检测Windows PE恶意软件.
- 开发的系统为静态恶意软件分析提供了高度准确和高效的解决方案.
- 这项研究为改善针对恶意软件的网络安全防御提供了一个强大的框架.
相关概念视频
01:29Viruses with RNA Genomes
58
RNA viruses are categorized into positive-strand, negative-strand, or double-stranded groups based on their genomic structure and replication mechanisms. This classification dictates how they exploit host cellular machinery for protein synthesis and replication. Some RNA viruses also utilize reverse transcription as part of their life cycle, further diversifying their replication strategies.Positive-Strand RNA VirusesPositive-strand RNA viruses have genomes that function directly as messenger...
58
01:19MALDI-TOF Mass Spectrometry
5.0K
Mass spectrometry is a powerful characterization technique that can identify and separate a wide variety of compounds ranging from chemical to biological entities, based on their mass-to-charge ratio (m/z). The instruments that allow this detection, known as mass spectrometers, have three components: an ion source, a mass analyzer, and a detector. These spectrometers differ based on the nature of their ion source and analyzers.
Matrix-assisted laser desorption ionization (MALDI) is a commonly...
Matrix-assisted laser desorption ionization (MALDI) is a commonly...
5.0K
01:12Types of Errors: Detection and Minimization
1.7K
Error is the deviation of the obtained result from the true, expected value or the estimated central value. Errors are expressed in absolute or relative terms.
Absolute error in a measurement is the numerical difference from the true or central value. Relative error is the ratio between absolute error and the true or central value, expressed as a percentage.
Errors can be classified by source, magnitude, and sign. There are three types of errors: systematic, random, and gross.
Systematic or...
Absolute error in a measurement is the numerical difference from the true or central value. Relative error is the ratio between absolute error and the true or central value, expressed as a percentage.
Errors can be classified by source, magnitude, and sign. There are three types of errors: systematic, random, and gross.
Systematic or...
1.7K
01:28Methods of Classification and Identification
55
Bacterial identification relies on a diverse array of techniques to classify and understand microorganisms, each tailored to uncover specific characteristics. Traditional morphological approaches, while still valuable, are limited for closely related or structurally simple organisms. Modern methods integrate biochemical, serological, genetic, and advanced molecular tools to achieve greater accuracy.Morphological and Biochemical TechniquesMorphological characteristics, such as cell shape and...
55
01:13Mass Analyzers: Overview
741
The mass analyzer is a crucial component of the mass spectrometer. In the ionization chamber, the vaporized sample is bombarded with a high-energy electron beam to generate a radical cation and further fragment into neutral molecules, radicals, and cations. A series of negatively charged accelerator plates accelerate the cations into the mass analyzer. The mass analyzer separates ions according to their mass-to-charge (m/z) ratios and then directs them to the detector. The common types of mass...
741
00:50What are Viruses?
115.4K
Overview
115.4K