Malware judgment device, malware judgment system, malware judgment method, program

摘要

In the malware determining unit (10) of the present invention, when an attribute name and an attribute value of an attribute of an executable file are inputted, the feature selection setting unit (11) sets an attribute of the attribute name as an attribute to be extracted in an attribute table And registers the attribute value in the attribute value table as a deletion target. When an execution file of a learning object or a determination object is input, the feature extraction unit (13) extracts attribute values of attributes registered as extraction targets from the execution file in the attribute table, and stores the extracted attribute values as features , And the feature selection unit (14) deletes the attribute value registered as a deletion target in the attribute value table from the feature vector.