A Machine Learning Approach to Anti - virus System

全文

(1)2004−ICS−138 (11) 2004／12／4. 社団法人情報処理学会研究報告 IPSJ SIG Technical Report. ! " !# % " & ' " " &" ' " ' * # & ) " *! - + ( " ' " "" ) /). ( ". '. ( ( &" & + + ' ,. ) "" " ". %. ' &. ". &. '. '&. ' ' 3453653785*. ( + "" ) ". ". &. 9 2: ". & 2. ( ". '. 2 2 +. '. '. !. " & &. ). ' " .. & " " & ". ". ". ( " " ( &" && * & " ) "& " 3;53<5*. ( -. ". && &. ) + (& " " ). ). 0. . &*. 2. *. '. & &. " & ( + (& " ' && (= ?7= A " "" ?;= " (" "" ?D= " &" @ ?7 " + ( ?; " " ' + ( " ? " " + ( * 2 A & E " " '' & &= " " " * ! & A F " ( + ( " & && " (& " ? . 9> 7:* ). " ' 2 ( & ) " += " & + (& " ) - + ( & ' " "" ) + ( (. ?7. ?. ?; ?D. A ?. '. ( " ' (" " 9 @ 9 &: ? 9 +" B " " ' "( & " " &. '. & '. '. &*. =2 = =!. " ". ' 1. )&. (. " " *. ' &. & (. *! && " &. '. .. ( " "* ! " &". (" ". ) '. ( &"* ! ". + (. 0. " & ). !. !$. & >9 & :. : !9 A : !9 , : C & * & "' =. : :. ),. '. & ). & '!. " /) /". =. " ?9. ' & 1. 1. &. 1. −61−. !. ". #. " - && & " . &) 2 " ) &" 2 ' 2 2 H 7 ; B +I " " A ' " " * ! & & ' = #= 7J ; BJ ⇒ E ( /) E &/ & ' 3K5* ! " ' ' & & = 2 " ' & + ( ' ". ' G. ". *.

(2) (. &. (. ( +. ) *. ( -. /. +. &. (. *. '. " (& ". 9 . F". ? = && ' ' ". ( && ) ). :. &. .. & 2 * ! & & (& ". AD B A I ),. +. 1 ". ". " (. $. %. !. A. ' '. " ". &. *! *.. " &. .. && * " E " " ) *> & '( ( ( ' " ' " & ( && && ' & ' &" *! " && ) A ) " ' & & "& ) ' ) * ' & & /" & " * ( && A && A )& " ' &" " " * & ' " ' " & " "" & " ' " * ' " L &F ' " " " *> A & & 2) & 2 ) * F' " " & & & " & *. ). & "" (& " && ), & '. . * & &. ". " ) ( ( & # " " ". '. %. '. &. * ). & ". ' & " ( ( &" & + " ' & ( ) &*. ). ' " '' ) ' " '' ' "* && " 0 " &. &. −62−. ". & ), '" '. (. = A∈. NN A ANNχ. ' ' & " " ;* )& ( & & & & " " * - "" A ( " & & ' A " 3D5* ! E " # 9': &. 7. #9': ≤ #. 9': O ε9'. " & ) ( & 'A # - * 1& " ) " ' && (=. ν: ε9' ν:. '" '. &. + A. &. && 7 ". ( " A,. " &. NNA PA,NNχ ' ; ". &&. "98:. ". "97: B + & - G7 GHA A,I ( ( & # 9' : Q8 " ' "A & 7 " A, NNA PA,NNχ G "9 : " ← ∪ HA A,I @. NNA PA,NNχ G "98: &. & ) & " ( ) & 3D5* ' " " " ' * ! & " * ( ( && ' && & ' ( && & ( & & A &&*. ;. && ". ". &. '. %. &. NN A F ANNχ G. (. F. + A. ). 1 " " 2 1 ". & &&. ". A &. ". & ?&. ". ' &. '. ) !. ". & ( &&. ". +. ( ' !. &' !. )&. ) &. * ) '. ' ' 9A: G. *. HA7 A; M* ! & ) ' "). & * !. ". '. ), & -. ". &. "'. ". 'A 0 )& @ '. ". * +. ). .. ( '. ". '. (. ). # &# +. ). && .. /. &+. " ) &. ). ( ( && -. &. " # & ). ' ". -. 1& "#. ' ). ( & ) & "" & *. = &. &. &&. ?7 && & + * (& " .. & .. .. (. ' & " 2. && + ". & C *.

(3) ,. % %. &. !. *. !. ' 2* & ( & E = ' ( " ' " ) +( " ' 3K5* @ ' ' " - + ( 2 ) & & ' A " ) " ' " ' " ' ' + ( " * " " ' + ( " ' & " ' + ( " & ' " * ) ' E " ' & & * ! 9 ( ) ' & :* " E & " ' & * > A & " + ( ? ( & ( " & ) & 3R5* ! " & & + ( ? ( . &) * ! " &+ > & " & ( & " " & ' & " ) " 2 .?* & & & 9> ;:*. ! &=. >9 ≤ 7≤ : ! 1& 7. !. > 9) ≤ 7 ≤ ": ! 1& ;. =. @ '. ! $. # !. #. &. & , ". *. ( ) ' = 9 7∈38*8 7*85: " 9 ;∈38*8 7*85:* ! & ' " * & A & ' & * & *!. ). ". & ". " ( " ' ". A ". % " > (. "" ". " (. &. D ( && &. =. −63−. A. " & ". =. ' & " & ' '( & ( " * ' A & ' ' " & " & ' '( " ( && & & & ) & & 7* + & ; ) & ' " & ;* D & ' '# & 7 ' '# & ; & ) " & ; & 7* &. ! ". ≤ ;≤ :. .9. =. '. '. ". ' ' ' * 7 (. ). # & ;. & " S* & '# & ; ' '# & 7 ) L "F ) # & ; ) && E L "F ) # & 7* S " & ;375* ( A ' / & & ( " "" ) * @ ) " & " ) & . # " ! " ) " " ( " ' & ' ' ' & * @ ( & )& ) ' " " & & " ' ( & " * ! " ' &* ! ' ' & & H . # !I " & & '. +. .9 ;≤ :.

(4) HT ≤ G ≥ QI* ! & & & " ' * ! " " & & & " & " ) & ' ' & *! ( & & " ) ' = # " ! * ! # ( " " & & " " ) + " *! ( " " & ) ' * ! & " " & & " ( ( & * ! ! ) & " ' " & " * " " & & "* ' " & & ") * ! & " ) )& & " ' " ) ' ), & ' * )& & ' ' * ! ' ) A & " " '' ) ( & ) ' A & ' ( & & ' & ) & ) & & " ) ' A & ' ( & ' ( " " ' " 375*. -. &'. .. '. + *. &. '. 7 >A. ! &. ; >A. >A. @ A ; 9> DR 7K< & ( " 78 888 888 ?* ! 1 & 7*; - 10 ( ;4R ? # @ " ( M0 0 ' & 9! )& 7:. S: -. " ' &. ; &. 1. D # S. + >. +. 4 1&. 2. +. 76R. 7. ). DDK D68. 7 7. ). K;<. 7;D. R. 2 K*8. '. 78;4. ;RD. K. '. ;. D;S. R48. 7864. 74R4. 2. <. 1. ( @ ' @ & ". *. = &. &. /'. ; * &. '. " &&. 2= !8 = != !7 =. & ( ). " ". ) ;. ; *. " &&= ' & '" ( 2 G7 '" ( 2 Q7 " '" ' ' ( 2 Q7 " '" ' ( 2 Q7 & ) ' & & - '" 9 ?: &" 9: &" " 9 ?/ : & & " ' && (=. "" " 2= 1= != = !7 !; ! " !7G! / 2 !;G 9! !8:/92 7:. ! G ! O 92 2 :×!; G 1 /! @ & 1 G78 888 888 ?C ( +(. . 2. !8. (. 2 2. # !. 2 G; 888C ! )& ;*. &. #. ' !7. !;. !. ; 764 8*S6< 8*76<K D;S. $=. *. '. !; =. !. ! 2 9: 764 7. !. 9 ?/ :. 46;*;S4. 7R<<S*6. 76R 8*R66 8*4KS< 7864 7DS4*8D< KSDS*KDS DDK D*<6K ;*R;46 78;4 44<R*7<< 7K68*7;6 D68 4*67< ;*KK8S K;< 46;<*8S7 7R<R*<6<. @ ' 2. −64−. &. ' " 9>. 4:. & A.

(5) S:. - - ' U* 1 ( +* 0 )& # . !. &. R: $. * *. !. (+ (. / ? ! " A. >. ' " ". ( ( &. #. 1 7666. #. K:. '. ). $ ! 4 766<*. 0 1 . ". & . " + ( * " ''. & # & '. <:. 0 U 0 #. " * 7: .. > & #. * . &&. 1 *. ). * ! ! &. &" 0 " +. - #. @*. # * & ( " 766< &* ! ,( ! ' ! / " "* ( + ! ;6 7666* ! ! ! 0 $ ! ,# ! ! 0 " ' 7 & 1 ' " " ! & * 78 7; > ) , DKS DKK* ! ! !. * '. 1. 1 " '. ( 0 "!. ! " &. ' ! 2 ' @ +* 78. #* @ ( "( " U* @ && 1* &" . " * 1 >* * ( , ! * ? ! U* @ 1 7666* 6: #* @ U '' * ". " * 1 * ( ! ' ! 3 0 $ % # * 0 " ' >' & 2 ? && 1 ' ? 7664 7<4 767* #* @ U '' * ". " *1 * ( ( ! ' ! *0 " ' A & 2 ? && 1 ' ? 766R * 7<6 ;8;*. (. "" "" &' A ' " ) ? ) + "? & & " "* A & & ; )& " '( + + ( / & * "" & & ' & & ' ' ) * & ' ) * ' , ( & & " & & ' ' & ? +" ! , + & B> & & &+ ! A ( ' "* A ( & ; '' " & ( & ' + * (. 1&. ". @. * D8. ;887* * ". ;: U '' ?* + ( #* @ * ! ( ! ! * 0 " ' 766K & 2 ? && 1 ' > 1 &' ) 766K* D: ?* # , #* @ & * " * ( # ! ! " ) $ ! ' * * $ ! * & 4 ) ;88D*. −65−.

(6)