网络与信息安全学报 ›› 2019, Vol. 5 ›› Issue (6): 21-30.doi: 10.11959/j.issn.2096-109x.2019059

• 学术论文 • 上一篇    下一篇

基于改进SOINN算法的恶意软件增量检测方法

张斌1,2,李立勋1,2,董书琴1,2()   

  1. 1 信息工程大学，河南 郑州 450001
    2 河南省信息安全重点实验室，河南 郑州 450001
  • 修回日期:2019-03-20 出版日期:2019-12-15 发布日期:2019-12-14
  • 作者简介:张斌（1969- ），男，河南南阳人，信息工程大学教授、博士生导师，主要研究方向为网络空间安全|李立勋（1994- ），男，四川都江堰人，信息工程大学硕士生，主要研究方向为动态目标防御|董书琴（1990- ），男，河北邢台人，信息工程大学博士生，主要研究方向为网络安全态势感知
  • 基金资助:
    河南省基础与前沿技术研究计划基金资助项目(2014302903);信息工程大学新兴科研方向培育基金资助项目(2016604703)

Malware detection approach based on improved SOINN

Bin ZHANG1,2,Lixun LI1,2,Shuqin DONG1,2()   

  1. 1 Information and Engineering University,Zhengzhou 450001,China
    2 Key Laboratory of Information Security of Henan Province,Zhengzhou 450001,China
  • Revised:2019-03-20 Online:2019-12-15 Published:2019-12-14
  • Supported by:
    Henan Province Foundation and Frontier Technology Research Project(2014302903);New Research Direction Cultivation Fund for Information Engineering University(2016604703)

在线阅读

37

pdf下载

557

摘要：

针对基于批量学习的恶意软件检测方法存在检测模型动态更新困难、运算存储开销大的问题，将改进的SOINN算法与有监督分类器有机结合，利用SOINN算法的增量学习特性赋予恶意软件检测模型动态更新能力，有效降低运算存储开销。首先对SOINN算法进行改进：在SOINN算法竞争学习周期内，根据全排列思想搜索所有样本输入次序下神经元的权重调节量，计算所有权重调节量的平均值作为神经元最终权重调节量，避免不同样本输入次序影响训练所得神经网络的稳定性，使所得神经网络更能反映原始数据本质特征，从而提高神经网络针对恶意软件检测的精度。然后采用非负矩阵分解和 Z-score 归一化对数据进行预处理，将恶意软件行为特征向量从高维高数量级转换至低维低数量级，在提高检测速度的同时有效降低高数量级维度对特征学习的不利影响，进一步提高检测准确性。实验结果表明，所提方法支持检测模型动态更新，对未知新样本的检测准确率显著高于传统检测方法，且运算存储开销更小。

关键词: SOINN算法, 恶意软件检测, 神经网络, 增量学习, 入侵检测

Abstract:

To deal with the problems of dynamic update of detection model and high computation costs in malware detection model based on batch learning,a novel malware detection approach is proposed by combing SOINN and supervised classifiers,to reduce computation costs and enable the detection model to update dynamically with the assistance of SOINN′s incremental learning characteristic.Firstly,the improved SOINN was given.According to the whole alignment algorithm,search the adjusted weights of neurons under all input sequences in the learning cycle and then calculate the average value of all adjusted weights as the final result,to avoid SOINN′s stability under different input sequences and representativeness of original data,therefore improve malware detection accuracy.Then a data preprocessing algorithm was proposed based on nonnegative matrix factor and Z-score normalization to transfer the malware behavior feature vector from high dimension and high order to low dimension and low order,to speed up and avoid overfitting and further improve detection accuracy.The results of experiments show that proposed approach supports dynamic updating of detection model and has a significantly higher accuracy of detecting unknown new samples and lower computation costs than tradition methods.

Key words: SOINN algorithm, malware detection, neural network, incremental learning, intrusion detection

中图分类号: 

No Suggested Reading articles found!