Unknown Virus Detection Based on Exceptional PE File Structure
Yang Qiu-xiang · Computer Technology and Development · 2009
Behavior-based analysis of currently unknown virus detection methods,necessary to run an executable file can be detected after,can not be detected in static form of computer virus file.In this paper,a document based on the static unknown virus detection of new technologies,by analyzing the PE file structure of the abnormal value,the use of Bayesian methods and support vector machine to identify the static and non-static unknown virus.Compared to behavior-based analysis of the unknown virus detection methods,do not need to run the executable file in the case of the possibility to detect the virus file is unknown.The method is compared to API function call sequence based on the data mining method of virus detection methods,the documents do not need to shell deal with such complex calculations clearly improve the detection speed.Test results indicate that the method of the unknown virus detecter has faster detection speed,higher recognition rate and lower rate of misjudgment.