Malware detection method based on dynamic multi-features

Abstract

A malware detection method based on dynamic multi-features. The method comprises the following steps of continuously delivering malware and normal software as samples to a client virtual machine running on a Xen virtualization platform: obtaining memory dump files of the client virtual machine by using LibVMI; using Volatility Memory Forensics Analysis Framework, several kinds of dynamic featuresbeing extracted from memory dump files, and the feature set is composed of these dynamic features; selecting the best base classifier, construct the final ensemble classifier, inputting the feature set into the ensemble classifier, finding out the best feature combination and ensemble learning model as the classification results and other steps. The invention has the advantages that the variety and reliability of acquiring characteristic data can be effectively improved, and the overhead of data acquisition can be reduced; by using the ensemble learning model, the generalization ability and classification accuracy of the whole classifier are effectively improved, and the generality of the classification model for different kinds of malware detection is enhanced.

Description

technical field [0001] The invention belongs to the technical field of computer information security, in particular to a malware detection method based on dynamic multi-features. Background technique [0002] In recent years, with the increasing number and types of malware, in order to reduce the pressure of manual analysis, malware detection methods based on machine learning are widely used. Generally, malware detection methods based on machine learning mainly include two processes of feature extraction and modeling of classification / clustering algorithms. Among them, according to whether malicious software is running during feature extraction, it can be divided into two methods: dynamic detection and static detection. [0003] (1) Static detection [0004] Static detection means that malware features and possible malicious behaviors can be analyzed without running malware, so the analysis process is relatively simple, safe and reliable. The basic idea of ​​static analys...

AI Technical Summary

Problems solved by technology

[0007] In general, first, the current static detection and dynamic detection methods of malware mainly extract features from the host, and the security mechanism is often at the same privilege level as the malware, and the acquired feature information is easy to be tampered with and deceived; Second, in the existing feature extraction methods, only a single type of feature is often extracted, which makes it difficult to detect complex malware; third, the existing machine learning methods are often only based on a single classifier model, and the generalization ability of the overall classifier Poor, not suitable for malware detection scenarios based on multi-class features

Images