A method of clustering detection for malicious code model based on K-L divergence

A method of clustering detection for malicious code model based on K-L divergence

Bengenqing Liang Shao Bilin

In the cloud computing application environment, because the service system is more and more complex, the network security loophole and the attack situation increase dramatically, the traditional malicious code detection technology and the protection pattern cannot adapt to the cloud storage environment demand. Therefore, by introducing the Gaussian mixture model, establishing the layered detection mechanism of malicious code, analyzing and extracting the characteristic value of sample data by means of information gain and document frequency, and combining the K-L divergence characteristic, a malicious code model clustering detection method based on K-L divergence is proposed. Using KDDCUP99 data Set, Weka Open source software is used to complete data preprocessing and clustering analysis. The experimental results show that the average detection time of malicious code in virtual environment is reduced by 16.6% and the average detection rate of malicious code is increased by 1.05% compared with Bayesian algorithm, which is based on the feature analysis of information gain and document frequency.

A method of clustering detection for malicious code model based on K-L divergence