A SVM-based method for detecting computer virus

In this paper, we propose a polymorphic viruses detection method based on support vector machine (SVM) in the Windows platform. Our approach rests on an analysis using the Windows API calling sequence that reflects the behavior of a particular piece of code. By extracting the variable-length system calling sequence or patterns in system calling sequence as the SVM training data and employing the ReliefF algorithm for estimating attributes previously obtained, then using cross-validation to experiment the arguments, the experimental results indicate that this method generates a relative small training data and higher accuracy than traditional ways which using fixed length of system calling sequence.