摘要： 恶意代码激增极大地威胁着信息系统安全。为提高辨识效率,加快应急响应速度,结合信息熵的定义,利用Jaccard度量和K最近邻分类算法,提出一种新的用于研究恶意代码分类的可视化方法。将二进制文件经局部熵计算转换成熵像素图,从视觉角度直观呈现恶意代码内部特征,通过降维显示机制提高相似度比对和分类的效率。实验结果表明,该方法使用66个族的664个由卡巴斯基命名规则命名的样本进行评估,平均分类准确率为93.67%,能有效地分类恶意代码样本。

关键词: 恶意代码, 可视化, 谱系分类, 信息熵, Jaccard指数, K最近邻分类算法

Abstract: Soaring malwares threat the security of information systems.For increasing identification efficiency and improving response speed,this paper presents a new malware visualization method for classification based on Shannon entropy,Jaccard index and K-Nearest Neighbor(KNN) algorithm.This method transforms binary files into entropy pixel images by computing the local entropy values of samples to show the inner features of malwares directly in the visual mode,and uses dimension reduction for display to accelerate the process of similarity and classification analysis.Experimental results show that the method is quite promising with 93.67% classification accuracy on 664 samples named by Kaspersky of 66 different families,it can classify malware families effectively.

Key words: malware, visualization, pedigree classification, information entropy, Jaccard index, K-Nearest Neighbor(KNN) classification algorithm

中图分类号: 

• TP309