N-Grams and Neural Networks in Early Virus Warning

Abstract: This paper proposes an intelligent first-warning system for virus code detection based on neural learning in an artificial neural network (ANN). The system operates in accordance with the basic principles of ANNs for pattern matching, in which the detectors detect a virus signature after training by means of analysis of the byte content of the executable code. ANNs provide the potential to identify and classify network activity based on limited, incomplete, and nonlinear data. The proposed system is capable of accurately detecting virus codes learned by training, and gives false positive ratios within acceptable ranges. The results of experiments conducted indicate that the combination of N-grams and neural networks results in a low false positive rate. The key ideas and approaches necessary for adaptation and adjustments when implementing a neural network model as an underlying early warning virus detection system are also discussed.

Keywords: neural networks, virus recognition, N-grams, antivirus software, ClamAV