一种基于行为分析和KNN算法的恶意软件检测模型

A Malware Detection Model Based on Behavior Analysis and KNN Algorithm

摘要: 为了解决传统恶意软件检测技术无法应对未知恶意软件的问题，提出了一种基于行为分析和KNN算法的恶意软件检测模型。该模型以总结归纳的恶意软件行为特征为基础，采用信息增益算法对行为特征进行降维，利用基于开源沙盒的行为提取引擎对样本的行为特征进行分析和提取，并在检测引擎中使用改进的KNN算法进行恶意软件的检测。实验结果表明，此模型具有良好的未知恶意软件检测能力，同时实现了较高的检测率、准确率以及较低的误报率。

Abstract: In order to solve the problem that traditional malware detection technology can’t deal with un-known malware, a malware detection model which is based on behavior analysis and KNN algo-rithm is proposed. On the basis of summarized behavior characteristics of malware, the model adopts information gain method to reduce dimensionality of behavior characteristics, and utilizes the behavior extraction engine which is based on open source sandbox to analyze and extract behavior characteristics and uses improved KNN algorithm in the detection engine to detect malware. The results of experiment demonstrate that the model has a good capability to detect unknown malware, and achieves a high FPR, AR and a low FPR.