Cơ chế máy học chấn đoán virus máy tính

When computer virus wide spreads in the world nowadays, anti-virus needs to improve their identifying methods to enhance the performance. In this paper, we introduce a new method to diagnose computer virus. First, we analyse the characteristics of viral data type to define virus classes through object-oriented methods. Second, we study the machine learnning mechanism for each virus class. Finally, we apply these learning forms to a data processing stage of a machine learning anti-virus expert system. The experimentation results show that the machine learning approach is suitable for anti-virus to identify the computer virus. This approach also gives a new aspect of anti-virus technology.
Nội dung trích xuất từ tài liệu:
Cơ chế máy học chấn đoán virus máy tính’Tap ch´ Tin hoc v` Diˆu khiˆn hoc, T.24, S.1 (2008), 32–41ıa `ee....’´ˆ ´ˆ´´INHCO CHE MAY HOC CHAN DOAN VIRUS MAY T´.. .´`ˆˆHOANG KIEM1 , TRU O NG MINH NHAT QUANG2.1Tru.o.ng Dai hoc Cˆng nghˆ Thˆng tin, DHQG TP.HCM`oeo. ..2 Trung tˆm D`o tao Dai hoc Tai ch´.c Cˆn Tho.aa .u `a. ..Abstract. When computer virus wide spreads in the world nowadays, anti-virus needs to improvetheir identifying methods to enhance the performance. In this paper, we introduce a new methodto diagnose computer virus. First, we analyse the characteristics of viral data type to define virusclasses through object-oriented methods. Second, we study the machine learnning mechanism for eachvirus class. Finally, we apply these learning forms to a data processing stage of a machine learninganti-virus expert system. The experimentation results show that the machine learning approachis suitable for anti-virus to identify the computer virus. This approach also gives a new aspect ofanti-virus technology.´´´´T´m t˘t. Trong bˆi canh c´c hˆ thˆng m´y t´ thu.o.ng xuyˆn bi virus tˆn cˆng, c´c hˆ ph`ngoao ’a e oa ınh`ea oa eo....o.ng ph´p nhˆn dang v` t˘ng cu.o.ng hiˆu qua chˆ n do´n. Trong’´´’ achˆng virus m´y t´ cˆn cai tiˆn phuoa ınh `a ’ eaaa .a a`e..’’´`b`i viˆt n`y ch´ ng tˆi gi´.i thiˆu phu.o.ng ph´p m´.i dˆ chˆ n do´n virus m´y t´ae auo oeao e aaa ınh. Dˆu tiˆn, virusae..o.c dinh ngh˜ hu.o.ng dˆi tu.o.ng theo d˘c tru.ng d˜. liˆu. Kˆ tiˆp, xˆy du.ng c´c mˆ h`´ ´´m´y t´ du . .a ınhıa ´oau ee eaao ınh....´’ y ’hoc th´ ho.p cho t`.ng l´.p virus. Cuˆi c` ng, ap dung c´c b`i to´n hoc v`o giai doan xu. l´ cua mˆtıch .uoo u´a a aao.....´ng virus m´y t´ hu.o.ng tiˆp cˆn m´y hoc v` hˆ chuyˆn gia. Kˆt qua thu.c nghiˆm cho´ a´’hˆ ph`ng chˆe ooa ınh ´e .a . a eeee....´’a aıch .aaaa ınh, mo. ra hu.o.ng nghiˆn c´.u´e uthˆy phu.o.ng ph´p n`y th´ ho.p cho b`i to´n nhˆn dang virus m´y t´a..m´.i trong cˆng nghˆ anti-virus ng`y nay.ooea.´.ˆ1. GIO I THIEU.Internet l` mˆi tru.`.ng thuˆn lo.i cho virus m´y t´ lˆy lan trˆn diˆn rˆng. M˘c d` c´ca ooa .a ınh aee oa u a.. ...ng cˆp nhˆt v` ph´t triˆ n, c´c hˆ´hˆ ph`ng chˆng virus (AV, Anti-virus software) khˆng ng`e ooouaa a ae’a e....˜n thu.`.ng xuyˆn bi virus xˆm nhˆp, d´nh c˘p v` ph´ huy d˜. liˆu. Do d´´ a a ’ u e´thˆng m´y t´ vˆoa ınh aoe .aaaao..`´´ .’ ee aa ınh, bao vˆ an to`n d˜. liˆu cho c´c hˆa u ea ecˆn nghiˆn c´.u cai tiˆn co. chˆ nhˆn dang virus m´y t´ae u ’ e.....i c´c phu.o.ng ph´p d˜ biˆt, ch´ng tˆi giai quyˆt´´´thˆng cˆng nghˆ thˆng tin (CNTT). Kh´c v´ aooe oa oa a euo ’e.`´ .b`i to´n nhˆn dang virus m´y t´ theo hu.´.ng tiˆp cˆn m´y hoc. Dˆu tiˆn ch´ng tˆi dinhaaaa ınhoe aaaeuo .....´.ng dˆi tu.o.ng 5 l´.p virus co. ban A, B, C, D v` E du.a v`o d˘c tru.ng d˜. liˆu cua´’’ngh˜ hu oıaooaa au e.....ng c´c b`i to´n hoc cho c´c l´.p virus du.a v`o c´c k˜ thuˆt hoc quych´ng. Sau d´ xˆy duuo aa aaa oa a ya .....˜´´ .’ aa . ınh onap, hoc chı dˆn, hoc vet, hoc tu.o.ng tu. v` hoc t` huˆng. Dˆ d´nh gi´ tiˆp cˆn, ch´ng tˆie’ aa e auo.... ...p 5 b`i to´n hoc v`o hˆ ph`ng chˆng virus m´y t´ hu.´.ng tiˆp cˆn m´y hoc v` hˆ´´ .t´ hoıch .aaoa ınhoe aa. a e o.. a e.´’chuyˆn gia MAV (Machine Learning Approach to Anti-virus Expert System). Kˆt qua thu.cee.´ .´nghiˆm cho thˆ y hˆ nhˆn dang ch´ x´c c´c virus d˜ cˆp nhˆt v` du. do´n trˆn 91% biˆn thˆea e a .ınh a aa aa a . aeee’.....i.virus m´o.’´ ´ˆˆ´´CO CHE MAY HOC CHAN DOAN VIRUS MAY T´INH.33’ˆ2. TONG QUAN`2.1. Kh´i niˆm vˆ virus m´y t´aeea ınh.´Virus m´y t´ (computer virus, trong b`i n`y goi t˘t l` virus) l` loai chu.o.ng tr` m´ya ınha a . a aa .ınh a.o.c thiˆt kˆ dˆ thu.c hiˆn c´c chı thi cua n´ sau chu.o.ng tr` kh´c [1]. B´ mˆt sao ch´p ban´ e e’ .´’ . ’ odu .ee aınh aı ae ’... m´y n`y sang m´y kh´c, l`m suy giam n˘ng’thˆn n´ v`o c´c hˆ thˆng m´y t´a o a a e oa ınh, virus lˆy t` a aa uaa aa. ´.c hoat dˆng hˆ thˆng v` xˆm pham d˜. liˆu ngu.`.i d`ng. Theo Bordera [2], virus m´y t´lue oa au eo ua ınh.. o.. ´... chı thi, thˆng tin, d˜. liˆu ho˘c chu.o.ng tr` l`m suy giam t´ ho`n thiˆn cua´’’ou eaınh aınh ael`: “bˆ t c´ ’ .aa u...’m ho˘c ph´ huy, ho˘c gh´p ban thˆn n´ v`o’’t`i nguyˆn m´y t´aea ınh, l`m vˆ hiˆu, gˆy nguy hiˆao eaeaaaea o a...t`i nguyˆn cua m´y t´ kh´c v` thi h`nh khi chu.o.ng tr` m´y t´ thi h`nh”.ae ’a ınh a aaınh a ınhaCh´ng tˆi phˆn loai virus du.a v`o d˘c tru.ng d˜. liˆu theo 5 l´.p nhu. sau:uoaa au eo.....p A (stand Alone program): c´c loai sˆu tr` c´ dinh dang u.ng dung dˆc lˆp.- L´oaınh o .o a. a. ´.. ..p B (Bo ...