A neural network ensemble based method for detecting computer virus

In this paper, a polymorphic viruses detection method based on neural network ensemble in the Windows platform is proposed. Our approach rests on an analysis using the Windows API calling sequence that reflects the behavior of a particular piece of code. Firstly, the system calling sequence of a program is extracted as eigenvector, and then bootstrap sampling is employed to generate several training subsets randomly. The member classifiers of the neural network ensemble are trained according to these subsets. Utilizing the Dempster-Shafer evidence theory, the member classifiers' intermediate results are combined to form the final detecting result of the ensemble. The experimental results indicate that this method generates more accurate results than traditional ways and the model proposed can adapt to the environment dynamically.