软件结构属性分析与恶意软件检测

软件结构属性分析与恶意软件检测 Analyzing of Software Structural Features and Malware Detection 程斌林 CHENG Binlin1 1 first-author 傅建明 FU Jianming1 1 2 3 许静 XU Jing1 1 武汉大学计算机学院 武汉大学计算机学院 School of Computer,Wuhan University School of Computer,Wuhan University 武汉大学空天信息安全与可信计算教育部重点实验室 武汉大学空天信息安全与可信计算教育部重点实验室 Key Laboratory of Aerospace Information Security and Trusted Computing ofMinistry of Education,Wuhan University Key Laboratory of Aerospace Information Security and Trusted Computing ofMinistry of Education,Wuhan University 武汉大学软件工程国家重点实验室 武汉大学软件工程国家重点实验室 State Key Laboratory of Software Engineering,Wuhan University State Key Laboratory of Software Engineering,Wuhan University 任何可执行文件都必须满足一定的结构特征.本文以Windows平台下的PE文件为研究对象,从PE头、节头、节代码出发,给出了17个结构特征;针对给定正常软件和各类恶意软件,获得了这些属性取值分布特征;采用多类数据挖掘分类技术获得了正常软件与恶意软件的判定规则.实验结果表明,C5.0的分类算法检测准确性最好,达到94.16%.这些规则可以为软件可信性度量提供依据. Every executive binary has a well-defined structure.On the basis of PE under Windows,seventeen structural features are given;values ranges are gained from different kinds of software: benign software and kinds of malware.And then the detection rules between benign software and malware are discovered by using several kinds of mining algorithm,among of which the C5.0 algorithm has the best accuracy,which is 94.16%.Also,this detection rules can be used to measure the trust of software. 可信软件 恶意软件 结构完整性 数据挖掘 trusted software malware structural integrity data mining 10.14188/j.1671-8836.2010.02.026 TP393.08 国家重点基础研究发展计划（973）项目（2007CB310800）;国家高技术研究发展计划（863）项目（2007AA01Z411）;国家自然科学基金（90718005,90718006）资助项目 2010-02-01 2021-04-01 2 56