An experimental comparative study on three classification algorithms on unknown malicious code identification

Dynamic behavior analysis is the direction of unknown malicious code identification. Taking API function called by malicious code as the research object during the peiriod of it being implanted and running, applying three classification algorithms: Decision Tree C4.5, NaiveBayes and Minmum Distance Classification to the identification of unknown malicous code, this paper compare and analyse their performances. The experients result show that, according to practical identification demand, choosing different identification algorithm will have a great effect on identification of unknown malicious code.