2种恶意代码行为特征统计方法的比较

随着恶意代码技术的更新,其检测技术变得日趋复杂,以启发式、前摄检测、行为检测和主动防御为代表的非特征码检测技术孕育而生,这些方法多数是利用了统计学原理。该文阐述了恶意代码行为的捕获方法和对恶意代码行为的统计方法,归纳了恶意代码行为的2种特征统计量定义方式;使用基于标准化欧式距离的分类器对这2种统计空间进行建模,并通过对建模结果的分析,得出了适用于最小距离分类器建模的行为特征统计空间。

Comparison between two statistics of a malicious code behavior feature

With the evolving of malicious codes,the technologies used to detect them have also become more complex.Some advanced technologies such as the heuristic method,proactive detection,behavior detection and the HIPS can collectively be referred to as 'non-signature' detection methods,but most of these methods all make good use of statistical theory.The methods for capturing and making statistical analysis of the malicious code behavior features are analyzed,and two types of statistics of malicious code behavior features are summarized.Based on the classifier with the normalized Euclidean distance,a model of the two types of statistical space is established,and the statistical space suitable to modeling with the minimum distance classifier is obtained according to the results of modeling.