Hierarchical feature selection method for detection of obfuscated malicious code
Gongde Guo · Journal of Computer Applications · 2012
Obfuscated malicious codes can easily escape from being detected by the conventional static method.On the other hand,despite its high detection accuracy,the dynamic method usually expends a large amount of system resources.A hierarchical feature selection method was proposed to improve the detection accuracy with relative low system overhead,where the features were generated and subsequently selected on the oriented layer,the individual layer,the family layer and the global layer,respectively.By the layer-by-layer refinements,an appropriate trade-off between the feature redundancy and information omission was archived using the hierarchical feature selection method.The experimental results on the real-world datasets demonstrate that the proposed method yields high accuracy for detecting obfuscated malicious code,while has several advantages such as smaller size of required training samples and better generalization ability compared with the conventional feature selection methods.