- 期刊
Malware Traffic Classification Based on Recurrence Quantification Analysis
摘要
To characterize the behavioral characteristics of different malware traffic more intuitively and identify malware traffic more accurately, a novel analysis and identification method based on recurrence property of malware traffic is proposed. According to the real malware traffic sequences generated by different malwares, a high-dimensional phase space of the malware traffic sequences is constructed, and then the recurrence properties of the state trajectories of malware traffic are analyzed to reveal their inherent behaviors. By analyzing feature vector acquired by Recurrence Quantification Analysis (RQA) statistically and being combined with machine learning, malware traffic can be well identified. Comparing with the traditional method which uses the common flow statistical features, the proposed method has higher classification accuracy (about 96.55%) using fewer features.