针对恶意JavaScript识别的降维方法

Using dimension reduction approach to identify malicious JavaScript

针对将JavaScript代码N-gram处理后识别算法特征维度较高的问题,提出一种高效的降维方法。该方法利用TF-IDF-like模型分别计算特征在正常样本和恶意样本中的权重,基于特征权重在两类样本中的差异度进行降维。基于多个识别算法,将提出的降维方法与基于主成分分析(Principal Component Analysis,PCA)的降维方法进行比较,实验结果表明:当识别算法维度相同时,基于本文所给降维方法的识别算法在识别效果方面优于基于PCA的识别算法;当降维后识别算法的维度超过某个阈值时,随着识别算法维度的增长,本降维方法的时间开销增长速率远低于PCA方法。

This paper proposes an efficient dimension reduction method to avoid the curse of dimensionality caused by using the N-gram model to identify malicious JavaScript.The method uses the TF-IDF-like model to calculate respectively the weight of features in normal samples and malicious samples,and carries out dimension reduction based on the difference feature weight.Based on many recognition algorithms,this paper compares the proposed method with the dimension reduction method based on Principal Component Analysis(PCA).The experimental results demonstrate two conclusions.Firstly,the recognition effect of the proposed method is better than that of PCA at the same feature dimension.Secondly,when the reserved dimension exceeds a certain threshold,with the increase of the reserved dimension,the growth rate of time cost is much lower than PCA.