Application of PrefixSpan* Algorithm in Malware Detection Expert System

Malware detection is an important application of data mining. Most of the previously developed sequential pattern mining methods are Apriori-like, which still encounters problems when a sequence database is large and/or when sequential patterns to be mined are numerous and/or long. So we need a novel sequential pattern mining method, called PrefixSpan*, which uses brief projection database in stead of projection database in PrefixSpan. In this paper, we propose a behavior-based detection system, which combines data mining and expert system technique to detect malware in our hosts. The PrefixSpan* algorithm mines association rules in the malware behavior sequence database to form malware behavior pattern database; the expert system matches facts and rules and gives the final result. To verify the correctness and effectiveness of our algorithm, we test and analyze some samples in the experiment section.