面向海量高维不平衡样本数据的恶意代码聚类及同源自动分析理论及技术

项目名称： 面向海量高维不平衡样本数据的恶意代码聚类及同源自动分析理论及技术

项目编号： No.61472437

项目类型： 面上项目

立项/批准年度： 2015

项目学科： 自动化技术、计算机技术

项目作者： 唐勇

作者单位： 中国人民解放军国防科技大学

项目金额： 82万元

中文摘要： 恶意代码发展已经进入APT（高级持续威胁）时代。由于恶意代码样本数据愈发呈现出海量高维不平衡特性，反病毒厂商的恶意代码自动分析体系面临着更巨大的挑战，已经表现出不适应APT时代的迹象，主要表现在两个方面：第一，有样本但是难以快速、准确地识别出新的恶意代码家族；第二，缺乏自动化的同源分析手段，难以及时了解恶意代码家族如何演化及其之间的关系。本项目针对上述问题和APT时代对恶意代码深度分析的更高要求，围绕恶意代码家族自动及时识别、恶意代码的同源和演化关系自动分析两大需求，立足于学术研究与反病毒厂商的紧密合作，设计适应APT时代的新一代恶意代码自动分析流水线体系，突破恶意代码高维特征向量自动提取和标准化、面向海量不平衡高维特征向量的恶意代码样本聚类算法、恶意代码同源和演化理论模型及自动化分析方法等关键技术。项目预期成果将推动恶意代码自动分析技术理论和工程技术的发展。

中文关键词： 恶意代码；病毒；同源；聚类；高级持续威胁

英文摘要： Malware development has entered the era of APT(Advanced Persistent Thread). Because malware sample data is increasingly showing a massive, high-dimensional and imbalant characteristics, anti-virus vendors' automatic analysis systems are facing more challenge, already can't adapt to the APT era, mainly in two aspects: first, even though samples are captured,it is still difficult to quickly, accurately identify a new malware family; second, the lack of automatical homology analysis results in the difficulty of understanding the evolution of malware family and their relationship. This project aims at solving the above problems and achieving the higher request of deeper malware analysis under the APT era. Centering on the two major demands of new malware family promptly recognition and automatic analysis of homologous and phylogenetic relationship of malware families, by a closely cooperation of the academic research and anti-virus vendors. This project will design a new generation of malware analysis pipeline system suitable for APT era and breakthroughs in some key technologies, including automatic extraction of malware high-dimensional feature vectors, massive high-dimensional imbalant malware samples clustering, automatic analysis method of malware homologency and derivation and its theory model. Through studious researches, we hope to promote the development of malware automatic analysis and anti-malware in theory and engineering technology.

英文关键词： Malware;Virus;Homologency;Clustering;APT