论文标题
通过机器学习方法对可执行文件的静态分析
Static analysis of executable files by machine learning methods
论文作者
论文摘要
本文介绍了如何基于对其二进制内容的静态分析来检测恶意可执行文件。分析了从可执行文件的不同区域提取的预处理和清洁数据的阶段。考虑了编码可执行文件的分类属性的方法，以及减少特征字段维度和选择特征特征以有效地表示二进制可执行文件的示例，以实现进一步的培训分类器。采用了一种合奏培训方法，以汇总每个分类器的预测，并创建了各种可执行文件属性组的分类器集合，以便随后开发一个系统，用于在无隔离环境中检测恶意文件。
The paper describes how to detect malicious executable files based on static analysis of their binary content. The stages of pre-processing and cleaning data extracted from different areas of executable files are analyzed. Methods of encoding categorical attributes of executable files are considered, as are ways to reduce the feature field dimension and select characteristic features in order to effectively represent samples of binary executable files for further training classifiers. An ensemble training approach was applied in order to aggregate forecasts from each classifier, and an ensemble of classifiers of various feature groups of executable file attributes was created in order to subsequently develop a system for detecting malicious files in an uninsulated environment.
