International Journal of Computational
Intelligence Research (IJCIR)
Volume 2, Number 1 (2006)
Using Support Vector Machine to Detect Unknown Computer Viruses
Zhang Bo-yun, Yin Jian-ping, Hao Jin-bo, Zhang Ding-xing, Wang Shu-lin
School of Computer Science, National University of Defense Technology Changsha 410073, China
Department of Computer Science, Hunan Public Security College, Changsha 410138, China
A novel method based on support vector machine (SVM) is proposed for detecting computer virus. By utilizing SVM, the generalizing ability of virus detection system is still good even the sample dataset size is small. First, the research progress of computer virus detection is recalled and algorithm of SVM taxonomy is introduced. Then the model of a virus detection system based on SVM and virus detection engine are presented respectively. An experiment using system API function call trace is given to illustrate the performance of this model. Finally, comparison of detection ability between the above detection method and other is given. It is found that the detection system based on SVM needs less priori knowledge than other methods and can shorten the training time under the same detection performance condition.
computer virus, API function calls, Support Vector machine, virus detection.