A malicious code detection method based on statistical analysis

The malicious code detection based on behaviors has proved effective. But there are high false positives and high false negatives when using this method. Because the behaviors are always out-of-order and redundant. To solve these problems, this paper proposes a detection method based on statistical analysis. Firstly, this method uses association rules to sort out the behaviors, and then we can get the integrated and accurate behavior sequences. Secondly, by using the association algorithm we can pick up the signatures of behavior sequences. In addition, this method can detect the signatures to judge the threat based on statistical analysis. Experimental results indicate that it can reduce both the false positives and the false negatives effectively.