一个基于Kullback-Liebler分歧的表示算法用于恶意软件检测
Faitouri A Aboaoja1,2, Anazida Zainal3, Fuad A Ghaleb1
1Faculty of Computing, Universiti Teknologi Malaysia, Johor Baru, Johor, Malaysia.
PeerJ. Computer science
|October 9, 2023
概括
这项研究引入了一种新的算法,通过分析恶意软件和良性软件之间的行为差异来准确地分类恶意软件. 基于Kullback-Liebler分歧的术语频率概率类分布 (基于KLD的TF-PCD) 方法显著提高了恶意软件检测的准确性.
科学领域:
- 网络安全 网络安全
- 机器学习 机器学习
- 软件工程 软件工程 软件工程
背景情况:
- 恶意软件对数字安全构成重大威胁,复杂的规避技术模糊了恶意和合法软件行为之间的界限.
- 传统的网络安全解决方案由于重叠的行为模式,难以准确区分恶意和良性活动.
研究的目的:
- 为改进恶意软件行为特征和分类提出一种新的算法.
- 解决TF-IDF等传统特征表示方法在准确权重恶意软件特征方面的局限性.
主要方法:
- 开发了一个基于Kullback-Liebler分歧的术语频率概率类分布 (基于KLD的TF-PCD) 算法.
- 该算法表示基于它们的概率分布在恶意软件和良性类别之间的差异的特征.
- 使用Kullback-Liebler分歧来增强重要的特征的权重,区分恶意软件和良性软件.
主要成果:
- 基于KLD的TF-PCD算法实现了高性能指标:0.972准确率,0.037假阳性率和0.978F-测量.
- 这些结果表明,与恶意软件分类方面的现有相关工作相比,有显著的改进.
- 提出的方法有效地提高了分类器准确识别恶意行为的能力.
结论:
- 基于KLD的TF-PCD算法通过引入有意义的特征,为恶意软件分类提供了更有效的方法.
- 这一进步有助于通过提高恶意行为检测的准确性来加强网络空间安全.
相关概念视频
Introduction to Virus
64
Viruses are unique biological entities that blur the boundary between living and non-living systems. Although they lack cellular structure and metabolic processes, they can exhibit characteristics of life when infecting a host. Their defining feature is a nucleic acid core, composed of either DNA or RNA, encapsulated within a protein coat called a capsid. This simple structure allows them to invade host cells and use their machinery for replication efficiently.Viral Structure and...
64
Viral Recombination
23.5K
Cells are sometimes infected by more than one virus at once. When two viruses disassemble to expose their genomes for replication in the same cell, similar regions of their genomes can pair together and exchange sequences in a process called recombination. Alternatively, viruses with segmented genomes can swap segments in a process called reassortment.
23.5K
MALDI-TOF Mass Spectrometry
4.9K
Mass spectrometry is a powerful characterization technique that can identify and separate a wide variety of compounds ranging from chemical to biological entities, based on their mass-to-charge ratio (m/z). The instruments that allow this detection, known as mass spectrometers, have three components: an ion source, a mass analyzer, and a detector. These spectrometers differ based on the nature of their ion source and analyzers.
Matrix-assisted laser desorption ionization (MALDI) is a commonly...
Matrix-assisted laser desorption ionization (MALDI) is a commonly...
4.9K


