NewMalicious CodeDetection Basedon N-gramAnalysis andRoughSetTheory

Motivated by thestandard signature-based techniquefor detecting viruses, weexplore theideaof automatically detecting malicious codeusing theNgramanalysis. Themethodisbasedonstatistical learning andnotstrictly dependent oncertain viruses. Wepropose theuseofroughsettheory (RST)to reducethefeature dimension. An efficient implementation tocalculate relative core, basedon positive region definition ispresented also. Thek nearest neighbor (KNN) andsupport vector machine (SVM)classifiers areusedtocategorize aprogram as either normal orabnormal. Theexperimental results arepromising andshowthattheproposed scheme results inlowrate offalse positive.