Abstract:

This paper proposes a fast malware classification method, which uses a novel dynamic feature based on path tree of behavior. This method performs dynamic analysis to obtain the fine granularity behavior execution traces of malware as the behavior path. These behavior paths are then structured as a tree, which characterizes the dependencies of behavior. It has lower complexity compared with traditional system call-based malware classification.In addition, the traditional classification model can’t finish depth optimization in path tree. To address this problem, this paper builds a classification model based on self-adaptation random forest. The method has been implemented and tested on a set of 2,588 malware instances in 9 families, and the classification accuracy achieves 91.11%.

Key words: path tree of behavior, malware classification, dynamic feature, self-adaptation random forest

摘要：

针对恶意软件家族分类问题，提出一种基于行为路径树的恶意软件分类方法，该方法使用恶意样本细粒度行为路径作为动态特征，通过将路径转化为树型结构的方式生成依赖关系，与传统基于系统调用的恶意软件分类相比，具有较低的复杂度。此外，针对传统分类模型无法解决行为路径树深度寻优问题，设计了基于自适应随机森林的分类模型，该模型采用随机逼近的方式完成行为路径树深度寻优。实验部分使用2?588个样本（包含8个恶意家族，1个良性集合）对行为路径树的有效性进行验证，分类精度达到91.11%。

关键词: 行为路径树, 恶意软件分类, 动态特征, 自适应随机森林