基于特征权重的恶意软件分类方法

Malware Classification Method Based on Feature Weights

近年来由于计算机和人们的工作生活结合得更加紧密,为保障信息安全,恶意软件分类的重要性与日俱增,但是现有的恶意软件分类方法大多都存在模型复杂、耗费时间长以及效果不突出等困境。为提高恶意软件分类效率,提出一个结合特征提取和卷积神经网络的恶意软件分类框架。针对目前恶意软件分类算法准确率低、处理时间慢等问题,引入并改进了NLP领域中的一种特征权重算法。通过计算操作码的特征权重,选取具有较大信息增益的操作码作为特征词,然后提取恶意样本的特征图,最后传入卷积神经网络进行训练和分类。实验结果表明,该方法在big2015数据集上的准确率为99.26%,比基于TFIDF特征提取的方法略好,接近该数据集上的冠军方法,在不均衡类别上的分类表现优于基于频率的特征词选择的提取算法,并且在预处理时间上短于其他方法。

In recent years,as computers and people’s work and life have become more closely integrated,the importance of malware classification has increased day by day to ensure information security.However,most of the existing malware classification methods have difficulties such as complex model,long time-consuming,and inconspicuous effects.In order to improve the efficiency of malware classification,a malware classification framework combining feature extraction and convolutional neural network is proposed.Aiming at the problems of low accuracy and slow processing time of current malware classification algorithms,a feature weighting algorithm in the field of NLP is introduced and improved.By calculating the feature weight of the opcode,the opcode with greater information gain is selected as the feature words,then the feature maps of the malicious sample is extracted,and passed into the convolutional neural network for training and classification at last.Experimental results show that the accuracy of the proposed method on the big2015 dataset is 99.26%,which is slightly better than the method based on TFIDF feature extraction.It is close to the champion method on this dataset,and the classification performance on unbalanced categories is better than that based on frequency.The extraction algorithm for feature word selection,and the preprocessing time is shorter than other methods.