Abstract: In view of the current behavior-based unknown virus detection methods need to run executable programs and can’t detect static virus such as dropper，the static method based on Win32 API behaviors for detecting unknown virus is proposed.Firstly parsing PE files to extract the sensitive Win32 API calls，then classifying the API functions based on malicious behavior and conducting a fixed dimension characteristic behavior vector into a database.With the feature extraction method of minimizing discriminant entropy，the redundant feature items are reduced，finally the improved K-Nearest Neighbor（KNN） algorithm is used to classify.The experiment results show that the method has a high hit rate and lower missing rate，suitable for unknown virus detection in Cloud Security system.

Key words: unknown virus detection, feature extraction, K-Nearest Neighbor（KNN） algorithm, reduce feature item

摘要： 针对目前基于行为分析的未知病毒检测方法需要运行可执行程序，无法检测出以静态形式存在计算机中的滴管等病毒的问题，提出了一种基于Win32 API相关行为检测PE未知病毒的方法。首先解析PE文件提取其调用的敏感Win32 API函数，然后将这些API函数按相关的恶意行为分类并形成维数固定的特征行为向量存入数据库。采用基于判别熵最小化的特征提取法自适应的精简特征项，最后利用改进的K-最近邻算法进行分类。实验结果表明，该方法具有较高的命中率和较低的漏判率，适用于“云安全”系统中未知病毒的检测。

关键词: 未知病毒检测, 特征提取, K-最近邻算法, 精简特征项