運用SVM以應用程式介面呼叫為特徵之惡意程式偵測

Malware Detection Based on API Call Usage Using SVM

曾宇辰(Yu-Chen Tseng)

指導教授 ： 田筱榮

中原大學/工學院/資訊工程研究所/碩士(2012年)

https://doi.org/10.6840/cycu201200697

摘要

惡意程式數量不斷快速增加，使得個人及企業電腦主機受到嚴重威脅，因此如何有效偵測出惡意程式顯得越來越重要，在目前商業防毒軟體大多採用建立特徵資料為主要偵測方法，但此方法不適用於未知惡意程式偵測，因此在本篇論文中我們提出一個可以應用在偵測未知程式的新作法，我們將程式常使用到的API進行分組，擷取程式使用的函數做為特徵運用支持向量機建立正常及惡意程式的分類模型，未知程式可依照同樣的方式擷取特徵後，使用訓練好的模型加以辨識，我們完成整個系統的設計與實作，我們的實驗顯示我們所以提出的方法可以達到比之前的研究更好的偵測效率。

關鍵字

libsvm ； 入侵偵測 ； SVM ； 惡意程式偵測 ； 系統安全

並列摘要

With the amount of malwares increases continually, computers are under serious security threats. An efficient and effective computer malware detection scheme is important to all. Pattern-based malware detection schemes are effective and efficient, but it is not able to recognize a malware if there is no pre-established pattern. This is a tremendous disadvantage since great damage can occur before a new malware is captured, analyzed and has its pattern found. On the other hand, a learning-based detection method has the potential to recognize a new malware, however, the efficiency and effectiveness of such methods are quite poor in comparison to the pattern-based schemes. In this thesis, we propose a new learning-based detection scheme with API calls usages in programs being the features. We carefully studied the properties of API calls and design a feature set accordingly for our learning-based scheme. An SVM based detection model is formed by using a set of training programs. A prototype of the proposed method has been developed and tested. It exhibit very high performance in terms of efficiency and effectiveness for both known and unknown programs.

並列關鍵字

malware detection ； SVM ； intrusion detection ； libsvm ； system security

參考文獻

[1] Zhang, B. Y., Yin, J. P., Hao, J. B., Zhnag, D. X., and Wang, S. L “Using Support Vector Machine to Detect Unknown Computer Viruses”

[4] Ye Y., Wang D., Li T. and Ye D. “IMDS: Intelligent Malware Detection System” Industrial and Government Track Short Paper, 2007

[5] Wang C., Pang J., Zhao R. and Liu X. “Using API Sequence and Bayes Algorithm to Detect Suspicious Behavior”, International Conference on Communication Software and Networks, pp. 544-548., 2009

[6] Ravi C. and Manoharan R. “Malware Detection using Windows API Sequence and Machine Learning” International Journal of Computer Applications Volume 43 No.17, April 2012

[7] Reddy D, Pujari A. “N-gram analysis for computer virus detection” Journal in Computer Virology; 2(3):231–239. ,2006