基于数据挖掘技术的加壳PE程序识别方法

Classification of packed PE files based on data mining

恶意代码大量快速的繁衍使得恶意代码自动化检测成为必然趋势,加壳程序识别是恶意代码分析的一个必要步骤。为识别加壳可执行程序,提出一种基于数据挖掘技术的自动化加壳程序识别方法,该方法提取和选取可移植可执行(PE)特征,使用分类算法检测PE文件是否加壳。测试结果表明,在使用J48分类器时加壳文件识别率为98.7%。

The proliferation of malicious code makes automatic malicious code detection an inevitable trend.Packed Portable Executable（PE） files identification is a necessary step of malicious code analysis.The paper presented an automatic identification method based on data mining,through which feature was extracted from PE files.The paper used classification algorithms and selected features to detect packed PE files.The test results show that the identification rate is 98.7% when using J48 classifier.