免疫合作机制驱动的高效恶意软件检测框架

106 浏览量更新于2024-08-26 收藏 306KB PDF 举报

本文主要探讨的是"基于免疫合作机制的学习框架"（Learning Framework Based on Immune Cooperation Mechanism），这一创新性的研究灵感来源于生物免疫系统（BIS）中的免疫合作（IC）原理。在传统计算机科学领域，特别是恶意软件检测（Malware Detection）中，研究人员试图设计出更高效的方法来识别和分类恶意软件。作者Pengtao Zhang 和 Ying Tan, IEEE高级会员提出了一个融合全球集中度（Global Concentration, GC）和局部集中度（Local Concentration, LC）的特征提取方法——混合集中度（Hybrid Concentration, HC）。该方法称为"混合集中度特征提取（Hybrid Concentration-Based Feature Extraction, HCFE）"，其核心思想是通过同时考虑样本的全局信息和局部信息，提供更为精确和全面的特征表示。与单一的全球或局部集中度不同，HCFE能够减少对单一视角的依赖，消除因过于集中于全局或局部特性而导致的偏见。这样，它不仅能够提高特征的鲁棒性，还能在处理复杂数据时保持良好的泛化能力。为了将HCFE应用到实际的恶意软件检测任务中，作者开发了一种基于混合集中度的恶意软件检测（HC-based Malware Detection, HCMD）方法。通过在三个公开的恶意软件数据集上进行交叉验证实验，总共八组测试结果显示，HCFE提取的混合集中度特征能显著提升HCMD方法的检测性能。具体来说，相比于基于全局集中度的传统方法，HCM检测模型的性能提升了大约3.28%，并且在速度方面也有大约2倍的提高，这表明HCFE框架对于解决恶意软件检测问题具有显著优势。此外，该工作还指出，传统的危险区域概念在人工免疫系统（AIS）中的必要性得到了重新评估，HCFE框架通过免疫合作机制的模拟和信号的协同作用，避免了这一概念的局限，进一步优化了学习框架的效率和效果。基于免疫合作机制的学习框架在恶意软件检测领域的应用展现了其在特征提取和分类性能上的显著优势，特别是在结合混合集中度特征提取策略后，该框架不仅提高了检测准确性，还提升了执行效率，为未来免疫系统启发的智能学习算法提供了新的可能性。

Hybrid Concentration Based Feature Extraction Approach for Malware

Detection

Pengtao Zhang and Ying Tan, Senior Member, IEEE

Abstract— In this paper, a hybrid concentration based feature

extraction (HCFE) approach is proposed. The HCFE approach

extracts the hybrid concentration (HC) of a sample in both

the global resolution and the local resolution. The HC of a

sample characterizes the sample more precisely and completely

by taking the global information and local information into

account at the same time. With the help of the co-operation of

the global and local information, the HC discards the bias of

the global concentration (GC) to the global information and the

local concentration (LC) to the local information, respectively.

In order to incorporate the HCFE approach into the procedure

of malware detection, a HC-based malware detection (HCMD)

method is proposed. Eight groups of experiments on three pub-

lic malware datasets are exploited to evaluate the effectiveness

of the HCMD method using cross validation. Comprehensive

experimental results suggest that the HC of a sample extracted

by the HCFE approach characterizes the sample more precisely

and completely than the GC and LC. The proposed HCMD

method outperforms the GC-based and the LC-based malware

detection methods in all the experiments for about 1.05% and

0.28% on average, respectively.

I. INTRODUCTION

Malware is a general term for all the malicious code that

is a program designed to harm or secretly access a computer

system without the owners’ informed consent [1]. According

to the malware’s method of operation, the malware can

be roughly broken down into several categories, such as

computer virus, Trojan horse and worm. Some adware is

also regarded as malware. The malware costs hundreds of

millions of dollars every year all over the world. It has

been one of the most terrible threats to the security of the

computers worldwide [2].

To address the problem of malware detection, a variety

of malware detection methods have been proposed, while

various commercial anti-malware products are available in

the market. These anti-malware solutions can be classiﬁed

into two categories: static methods and dynamic methods.

The static methods attempt to detect malware without actu-

ally running any code. They are mainly based on machine

learning and data mining methods, and heuristic theories

(such as artiﬁcial immune theory [3][4]). The static methods

usually work on the binary string or application programming

interface (API) calls of a program, so they are portable

and can be deployed on personal computers. The dynamic

methods keep watch over the execution of every program

Y. Tan is the correspondent author with the Department of Machine

Intelligence, School of Electronics Engineering and Computer Science,

Peking University, Beijing, 100871, China. E-mail: ytan@pku.edu.cn.

P.T. Zhang is a PhD candidate with the Department of Machine Intel-

ligence, School of Electronics Engineering and Computer Science, Peking

University, Beijing, 100871, China. E-mail: pengtaozhang@gmail.com.

during run-time, observe its behavior, and stop it once it

tries to harm the system, such as behavior blockers, virtual

machines. The dynamic methods bring too much extra load.

Hence they are usually used to analyze malware in the

computer security ﬁrms instead of to detect malware in

personal computers.

Inspired by human immune system, the immune con-

centration has been proposed as an effective feature [5].

There are two concentration based features so far : the

global concentration (GC) and the local concentration (LC).

The GC was proposed ﬁrstly for spam detection [5][6] and

later applied to detect malware [7]. Although the GC-based

methods perform very well in the two problems, the GC

merely contains the global information of a sample extracted

in the global resolution. This design results in its bias to the

global information, ignoring the local information, and a high

diluent risk. To overcome the diluent risk of the GC, the LC

was proposed [8][9]. The LC zooms out the concentration

information and stores the position-correlated information

implicitly by deﬁning a local area. However, the LC ignores

the global information and merely characterizes a sample

from the perspective of a local resolution, resulting in its

bias to the local information. Furthermore, the stability of the

position-correlated information should be under suspicion.

How to design and extract a discriminating immune concen-

tration based feature, discarding the bias of the GC and LC

to the global information and local information, respectively,

becomes a worthwhile work.

In this paper, a hybrid concentration based feature ex-

traction approach is proposed by taking inspiration from

the GC and LC. The HCFE approach extracts the hybrid

concentration (HC) of a sample in both the global resolution

and the local resolution. The HC of a sample characterizes

the sample more precisely and completely by taking the

global and local information into account at the same time. It

discards the bias of the GC and LC, respectively, to the global

information and local information. In order to incorporate the

HCFE approach into the procedure of malware detection, a

HC-based malware detection (HCMD) method is proposed.

Extensive experimental results demonstrate that the pro-

posed HCMD method is effective to detect unseen malware.

It outperforms the GC-based and LC-based malware detec-

tion methods in the eight groups of experiments on the three

malware datasets for about 1.08% and 0.28% on average,

respectively.

The rest of the paper is organized as follows. In Section

II, we introduce the related work. In Section III, we give the

deﬁnition of the HC and describe the HCFE approach in de-

Proceeding of the IEEE 28th

Canadian Conference on Electrical and Computer Engineering

Halifax, Canada, May 3-6, 2015

140

下载后可阅读完整内容，剩余5页未读，立即下载

weixin_38590989

粉丝: 8
资源: 940

免疫合作机制驱动的高效恶意软件检测框架

基于免疫规则的入侵检测框架

Java语言实现的人工免疫入侵检测框架

基于免疫机制的通用访问控制框架 (2008年)

基于免疫原理的业务冲突管理系统框架研究

基于免疫系统的云计算环境入侵检测框架研究

基于免疫理论的业务冲突管理框架：融合检测与解决

基于免疫算法的联邦学习异常节点检测Python实现

基于免疫的网络安全风险检测分析.pdf

基于免疫理论的物联网站点健康监测与风险评估

biocellion:基于Biocellion代理的建模框架的单节点版本

最新资源