A Research on the Heuristic Signature Virus Detection Based on the PE Structure

Abstract

With the development of network technology, computer networks are becoming increasingly popular in people's daily life. Computer brings us not only convenience but also potential problems caused by computer viruses. Most viruses are Win32 PE viruses. This paper firstly analyzes the Win32 PE file structure, then analyzes the virus's Principles of infection in detail and finds the PE virus Heuristic feature vector and stores Heuristic feature vector into a database. It reduces the redundant feature items with the feature extraction method of minimizing discriminate entropy. Finally the improved KNN algorithm is used to classify. The experiment results show that the method has a high hit rate and lower missing rate.