An Automatic Malware Homology Identification Method Based on Calling Habits

QIAO Yan-chen; YUN Xiao-chun; ZHANG Yong-zheng; LI Shu-hao

doi:10.3969/j.issn.0372-2112.2016.10.019

您当前的位置：

首页 >

文章列表页 >

An Automatic Malware Homology Identification Method Based on Calling Habits

更新时间：2025-07-16

- An Automatic Malware Homology Identification Method Based on Calling Habits
- Acta Electronica Sinica Vol. 44, Issue 10, Pages: 2410-2414(2016)
- 作者机构：
  
  1. 中国科学院计算技术研究所,北京,100190
  2. 中国科学院大学,北京,100049
  3. 中国科学院信息工程研究所,北京,100093
  4. 中国科学院计算技术研究所,北京,100190
  5. 中国科学院大学,北京,100049
  6. 中国科学院信息工程研究所,北京,100093
- 作者简介：
- 基金信息：
- DOI：10.3969/j.issn.0372-2112.2016.10.019
  CLC： TP393.08
- Published：2016
- 稿件说明：
移动端阅览
QIAO Yan-chen, YUN Xiao-chun, ZHANG Yong-zheng, et al. An Automatic Malware Homology Identification Method Based on Calling Habits[J]. Acta Electronica Sinica, 2016, 44(10): 2410-2414.
DOI：

QIAO Yan-chen, YUN Xiao-chun, ZHANG Yong-zheng, et al. An Automatic Malware Homology Identification Method Based on Calling Habits[J]. Acta Electronica Sinica, 2016, 44(10): 2410-2414. DOI： 10.3969/j.issn.0372-2112.2016.10.019.

摘要

恶意代码同源判定对作者溯源、攻击事件责任判定、攻击场景还原等研究工作具有重要作用.目前恶意代码同源判定方法往往依赖人工分析，效率低下，为此，提出一种基于调用习惯的恶意代码自动化同源判定方法.该方法基于7类调用行为，使用数据挖掘算法构建作者编程习惯模型，基于频繁项离群检测算法计算同源度，利用K均值聚类算法选择同源判定阈值，进而实现恶意代码同源判定.实验结果表明，该方法具有99%以上的准确率和可接受的召回率.

Abstract

Malware homology identification is useful for malware authorship attribution

attack scenario restoration

and so on.Current malware homology identification methods still rely on manual analysis

which is inefficient and time-consuming.In order to improve the effectiveness and efficiency

an automatic malware homology identification method is proposed.Based on 7-class calling behaviors

this method constructs a model of calling habits using data mining algorithms.Then it calculates the degree of homology based on Frequent Pattern Outlier Factor.Finally

it chooses the threshold values using k-means clustering algorithm to identify homology.The experimental evaluations on real-world malwares show our method achieves high accuracy (over 99%) and acceptable recall rate.

关键词

Keywords

references

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

A Malware Classification Method Based on MP-FSCIL

P2P-Based Super Botnet:Threats and Defenses

A Survey of Zero Trust Management for Large-Scale Internet of Things

Malware Classification Method Based on Improved CNN

Research on Modeling of Latent Virus Propagation Behavior with Increasing or Decreasing Network Nodes

Related Author

WANG Jian

LIU Qiang

WANG Lei

YING Ling-yun

FENG Deng-guo

SU Pu-rui

XING Fang-yuan

DONG Ao

Related Institution

Air Defense and Antimissile School, Air Force Engineering University

Air Traffic Control and Navigation School, Air Force Engineering University

State Key Laboratory of Information Security,Graduate University of Chinese Academy of Sciences

State Key Laboratory of Information Security,Institute of Software,Chinese Academy of Sciences

State Key Laboratory of Information SecurityGraduate University of Chinese Academy of SciencesBeijing 100080China

⁰