关键词: 行为路径树, 恶意软件分类, 动态特征, 自适应随机森林

Abstract:

This paper proposes a fast malware classification method, which uses a novel dynamic feature based on path tree of behavior. This method performs dynamic analysis to obtain the fine granularity behavior execution traces of malware as the behavior path. These behavior paths are then structured as a tree, which characterizes the dependencies of behavior. It has lower complexity compared with traditional system call-based malware classification.In addition, the traditional classification model can’t finish depth optimization in path tree. To address this problem, this paper builds a classification model based on self-adaptation random forest. The method has been implemented and tested on a set of 2,588 malware instances in 9 families, and the classification accuracy achieves 91.11%.

Key words: path tree of behavior, malware classification, dynamic feature, self-adaptation random forest