基于WIG-GA特征选择算法的恶意代码检测方法

Malicious Code Detection Method Based on WIG-GA Feature Selection Algorithm

摘要: 针对当前恶意代码检测中特征高维度问题，本文提出一种基于引入频率权重因子的信息增益算法和遗传算法相结合的恶意代码特征选择方法，该方法可以选择出能够有效区分正常代码与恶意代码的最优特征子集，实现特征的降维。该方法利用遗传算法较强的全局搜索能力进行特征子集的搜索，同时采用基于频率权重因子的信息增益算法作为特征子集的适应度评价，最后在当前流行的多种分类方法中进行学习和验证。通过实验表明：该方法可以有效的降低恶意代码检测中特征的维度，有效的提高了分类器的学习效率和精度。

Abstract: In order to solve the problem of feature dimensionality in current malicious code detection, this paper proposes a method of feature selection of malicious code based on information gain algorithm which introduces frequency weight factor and genetic algorithm. This method can select the optimal feature subset that can effectively distinguish between normal code and malicious code, and achieve dimensionality reduction. This method uses the strong global search ability of genetic algo-rithm to search the feature subset. At the same time, the information gain algorithm based on the frequency weighting factor is used as the fitness evaluation of the feature subset. At last, we use a variety of popular classifiers to learn and verify. Experiments show that this method can effectively reduce the dimensions of features in malicious code detection and effectively improve the learning efficiency and accuracy of the classifier.