The invention discloses a novel file-static-structure-attribute-based
malware detection method, in particular a detection method for portable execute (PE) files and
executable and linkable format (ELF) files. The method comprises the following steps of: in a
training phase, extracting a file sample
static structure attribute; preprocessing data, performing selection filtering by using a selectionfiltering
algorithm and training a classifier by using the data; and in a detecting phase, classifying detected files by using the trained classifier according to the filtered
static structure attribute to obtain a result indicating whether the files are
malware or normal files. The novel file-static-structure-attribute-based
malware detection method detects known or unknown malware with the accuracy of over 99 percent, has short detection time, occupies a few
system resources and can be actually deployed in antivirus
software. The method is not influenced by technology such as packing,
aliasing, deformation, polymorphism and the like, can be applied to Windows and Linux platforms at present and also can be applied to embedded platforms such as various mobile phones, palm computers and the like.