基于机器学习的恶意软件识别研究综述

Survey on Machine-learning-based Malware Identification Research

恶意软件的泛滥给网络用户、企业、工业设施、网络和信息设备等带来严重的安全威胁.近年来,传统基于签名和启发式规则的恶意软件识别方法已不足以应对急剧增长的新型恶意软件.针对于此,大量机器学习方法被尝试用来更好地解决恶意软件识别问题.在广泛调研国内外大量文献及最新科研成果的基础上,以特征表示的获取为分类依据,按照基于特征工程的方法和基于特征学习的方法两类对当前基于机器学习的恶意软件识别研究进展进行了归纳和介绍,并整理了目前已公开的可用于训练机器学习的恶意代码数据集.在总结当前研究现状的基础上,进一步展望了基于机器学习的恶意软件识别当前面临的问题和挑战.

The proliferation of malware has brought serious security threats to network users,enterprises,industrial facilities,networks,and information equipment.Recently,traditional malware identification methods based on signatures and heuristic rules are no longer sufficient to deal with the rapid growth of new malware.To addressing this issue,a variety of machine learning algorithms have been used to better solve the malware identification task.Based on an extensive investigation of a large volume of literature and the latest research achievements at home and abroad,this paper summarizes and surveys the current research progress of malware identification based on machine learning.According to the acquisition method of feature representation,we divide existing methods into two categories,i.e.,feature-engineering-based and feature-learning-based,and review each category separately.We also summarize public malware datasets that can be used for training and evaluating machine learning models.Based on the review of existing research,we look forward to the open problems and challenges of malware identification based on machine learning.