摘要：

根据机器学习中分类和集成学习理论,设计一种高性能的Linux病毒检测方法。通过训练得到若干基分类器,然后将基分类器的分类结果进行整合,以获得最终检测结果。该方法以ELF文件特征为样本特征、BP神经网络为基分类器,用AdaBoost算法进行基分类器的训练和整合 。对AdaBoost算法的基分类器权重计算及基分类器整合部分进行改进,使之更适用于病毒检测问题。实验结果表明,该方法的病毒检测效果优于Avria Linux和F-PROT方法。

关键词: 病毒检测, AdaBoost算法, BP神经网络, ELF文件特征, D-S证据理论

Abstract:

A high-performance Linux virus detection method is designed using the theory of classification and integration learning in machine learning.This method is,first to train and obtain a number of base classifiers,then to integrate the base classifiers’ classification results to get the final detection result.The method extracts the ELF file feature as the sample feature,and selects BP neural networks as the base classifiers,and uses the improved AdaBoost algorithm to train and integrate the base classifiers.In the Adaboost algorithm,the weight calculation method and integration method of the base classifiers are improved,which makes this algorithm more suitable for the virus detection problem.Experimental results show that the effectiveness of the proposed detection method is verified by relative experiments,which is better than Avria Linux and F-PROT methods.

Key words: virus detection, AdaBoost algorithm, BP neural network, ELF file feature, D-S evidence theory

中图分类号: 

• TP391