基于PE静态结构特征的恶意软件检测方法

针对现有检测方法的不足,提出了一种通过挖掘PE文件结构信息来检测恶意软件的方法,并用最新的PE格式恶意软件进行了实验。结果显示,该方法以99.1%的准确率检测已知和未知的恶意软件,评价的重要指标AUC值是0.998,已非常接近最优值1,高于现有的静态检测方法。同时,与其他方法相比,该检测方法的处理时间和系统开销也是较少的,对采用加壳和混淆技术的恶意软件也保持稳定有效,已达到了实时部署使用要求。此外,现有的基于数据挖掘的检测方法在特征选择时存在过度拟合数据的情况,而该方法在这方面具有较强的鲁棒性。

Malware Detection Approach Based on Structural Feature of PE File

In order to solve the problems existing in malware detection, we proposed a novel malware detection approach by mining structural features of PE (Portable Executable) files and conducted the against recent Win32 malwares. Experimental results indicate that the accuracy of our method is 99. 1% and the value of the AUC is 0. 998 which is close to 1(The AUC value of the best possible classifier) and better than that of other static approaches. Compared with other static approaches, our method achieves higher detection accuracy with less detection time, is hard to evade by malware which applies the obfuscation and packing technique, and is real-time deployable. Most malware detection approaches using data mining may overfit experimental data in feature selection, but our experiments show that our method overcomes this problem.