融合多种特征与模型，实现高精度恶意软件分类。
A Hybrid Approach For Malware Classification Using Secondary Features Fusion
- 提取API调用、n-gram等特征，通过自定义选择融合
- 在微软数据集上达99.72%准确率，AUC 0.989
- 适合安全研究者和反病毒系统开发者参考
恶意软件数量迅速增长，传统检测方法难以识别其家族归属，影响有效应对。本文提出一种自动化检测与分类方法，通过提取API调用、固定与可变长度n-gram等特征，并采用定制化特征选择进行融合；预测阶段采用投票机制集成多个算法。在微软提供的数据集上，分别进行二分类与多分类实验，结果表明该方法在准确率99.72%、AUC 0.989、对数损失0.01的指标下表现优异，优于现有技术。
原文摘要 · Abstract (English)
The number of malware (either variant or novel) is rapidly increasing, making malware detection and mitigation a complex problem. One approach to improving malware mitigation is automatic detection and malware family classification. However, traditional malware detection methods cannot classify detected malware into their respective families, hindering effective malware mitigation. Consequently, this paper proposes a method to automate malware detection and classification of the detected malware into respective malware families. The proposed method uses feature fusion after extracting relevant malware features such as API calls and fixed and variable length n-grams with a customized feature selection method. Moreover, for the predictive model, a voting based approach is proposed for algorithm fusion. For the experimental evaluation of the proposed method, both binary and multi-class classification approaches are applied to the data set provided by Microsoft. Finally, the experimental results are compared with the state of the art. The experimental results indicate the effectiveness and efficiency of the proposed approach with an AUC of 0.989, accuracy of 99.72%, and a log loss of 0.01.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。