Fuzzy reasoning model for analysis of program maliciousness - FU Wen; WEI Bo; ZHAO Rong-cai; PANG Jian-min (Tongxin xuebao)
Boolean logic can not describe fuzzy concepts, such as similarity degree. However, the similarity degree of two programs is usually used to determine that whether one program of these two is a variant of the other. To detect malware, a model for analysis of program maliciousness was put forward based on fuzzy reasoning. In this model, malicious characteristics of a program were abstracted using fuzzy pattern recognition firstly. Then the maliciousness of this program was quantitatively analyzed by probability method. Finally, whether the program is malicious was determined approximately using a fuzzy reasoning algorithm. Experimental results show that the prototype based on this model is good at detecting unknown malicious programs and malware variants.