Classification of polymorphic virus based on integrated features

Standard virus classification relies on the use of virus function, which is a small number of bytes written in assembly language. The addressable problem with current malware intrusion detection and prevention system is having difficulties in detecting unknown and multipath polymorphic computer viru...

全面介绍

Saved in:
书目详细资料
Main Authors: A Hamid, Isredza Rahmi, Subramaniam, Sharmila, Sutoyo, Edi, Abdullah, Zubaile
格式: Article
语言:English
出版: Insight - Indonesian Society for Knowledge and Human Development 2018
主题:
在线阅读:http://eprints.uthm.edu.my/5013/1/AJ%202018%20%28816%29%20Classification%20of%20polymorphic%20virus%20based%20on%20integrated%20features.pdf
http://eprints.uthm.edu.my/5013/
标签: 添加标签
没有标签, 成为第一个标记此记录!
实物特征
总结:Standard virus classification relies on the use of virus function, which is a small number of bytes written in assembly language. The addressable problem with current malware intrusion detection and prevention system is having difficulties in detecting unknown and multipath polymorphic computer virus solely based on either static or dynamic features. Thus, this paper presents a classification of polymorphic virus based on integrated features. The integrated feature is selected based on Information Gain rank value between static and dynamic features. Then, all datasets are tested on Naïve Bayes and Random Forest classifiers. We extracted 49 features from 700 polymorphic computer virus samples from Netherland Net Lab and VXHeaven, which includes benign and polymorphic virus function. We spilt the dataset based on 60% for training and 40% for testing. The performance metric of accuracy value, receiver operating characteristic and mean absolute error are compared between two algorithms in the experiment of static, dynamic and integrated features. Our proposed integrated features manage to achieve 98.5% of accuracy value using highest rank feature selection.