An Approach of Malicious Executables Detection on Black & Gray Based on AdaBoost Algorithm

作者：Liu Lei^*; Shao Kun

来源：2nd International Conference on Anti-Counterfeiting, Security and Indentification, Guiyang, 2008-08-20 To 2008-08-23.

DOI：10.1109/IWASID.2008.4688357

• malicious executable
• malicious host behaviors
• style
• Adaboost algorithm
• ROC

Behavioral analysis refers to the technique of deciding whether an application is malicious or not, according to what it does. With behavioral analysis research on executables evolving, it is difficult to classify malicious applications and some legal applications called 'gray application', which are classified as malicious sample by 'weak' learners. In theory, boosting can be used to significantly reduce the error of 'weak' learning algorithm that consistently generates classifiers which need only be a little bit better than random guessing. This paper presents an approach based on a new boosting algorithm called AdaBoost, which improves the performance of any 'weak' learning algorithm. Experiment results show that the method has good classification accuracy in experiment data sets.

• 出版日期2008
• 单位合肥工业大学