A Novel Solutions for Malicious Code Detection and Family Clustering Based on Machine Learning

IEEE Access

Hui Lu¹  Shudong Li¹  Hangfeng Yang¹  Weihong Han¹  Xiaobo Wu² 

[1] Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China;School of Computer Science and Cyber Engineering, Guangzhou University, Guangzhou, China;

关键词: Malware;    ensemble model;    malware classification;    family clustering;    t-SNE;   

DOI  :  10.1109/ACCESS.2019.2946482

来源: DOAJ

【 摘 要 】

Malware has become a major threat to cyberspace security, not only because of the increasing complexity of malware itself, but also because of the continuously created and produced malicious code. In this paper, we propose two novel methods to solve the malware identification problem. One is to solve to malware classification. Different from traditional machine learning, our method introduces the ensemble models to solve the malware classification problem. The other is to solve malware family clustering. Different from the classic malware family clustering algorithm, our method introduces the t-SNE algorithm to visualize the feature data and then determines the number of malware families. The two proposed novel methods have been extensively tested on a large number of real-world malware samples. The results show that the first one is far superior to the existed individual models and the second one has a good adaptation ability. Our methods can be used for malicious code classification and family clustering, also with higher accuracy.

【 授权许可】

Unknown