Virus detection method based on ensemble classification

Abstract

The invention discloses a virus detection method based on ensemble classification, belonging to the technical field of network security. A feature extraction module and an ensemble classification module are contained in the virus detection method, wherein feature extraction means that an instruction sequence feature of a virus is extracted by adopting a static feature extraction method to form a feature set; and n instruction sequence features with maximum information grain in the feature set are selected as an optimal feature set. The ensemble classification means that an artificial nerve network is introduced to construction of an ensemble classification algorithm, a novel mode classifier (GRAB(Generalization Regression neural network based AdaBoost)) is provided by combining an AdaBoost algorithm to realize the detection of the virus so as to achieve the aims of effectively improving the detection accurate rate and particularly detecting unknown virus accurately. According to the virus detection method disclosed by the invention, viruses and normal programs can be distinguished more effectively and the unknown virus can be detected accurately.

Description

technical field [0001] The invention relates to a virus detection method, in particular to a virus detection method based on integrated classification. Background technique [0002] With the rapid development of computer network, especially Internet technology, network has become the most important part of human society, and it is the most outstanding research achievement in the 20th century. While the degree of network interconnection is expanding day by day, the issue of network security becomes extremely important. Among all network security incidents, the intrusion of computer viruses occupies the largest proportion. The number of viruses is increasing and its spread is becoming more and more widespread, which has brought huge economic losses to the world. [0003] Traditional antivirus technology can only detect viruses by analyzing virus samples, extracting signatures, and updating virus signature databases after the virus has caused damage. However, when an unknown...

AI Technical Summary

Problems solved by technology

[0004] Most of the existing anti-virus technologies detect computer viruses with the method of signature comparison. This detection method first extracts the characteristics of known virus samples, and adds their characteristic data to the virus signature database. Search in the database to find out if there is a matching virus signature to find the virus. The disadvantage is that it can only be used to detect known viruses, but it is powerless to new and unknown viruses.

In recent years, many studies have shown that the use of machine learning can effectively detect unknown malicious code, and its disadvantage is that the error rate is too high

Images