Classification system and classification method of computer rogue programs based on file instruction sequence

Abstract

The invention relates to a classification system and a classification method of computer rogue programs based on file instruction sequence. The classification system of computer rogue programs based on file instruction sequence comprises an instruction sequence feature extraction module used for generating aggregation of instruction segments, a sample file diversity factor calculation module used for calculating the diversity factor between two sample points; a dimensionality weight calculation module used for calculating the weight of each dimensionality of each family and dimensionality weight vectors of families and a sample family division module used for calling all modules to complete family division of all sample points. The device can reasonably divide families of rogue program samples according to the file instruction sequence.

Description

technical field [0001] The invention relates to the field of computer anti-malicious program software, in particular to a system and method for classifying computer malicious programs based on file instruction sequences. Background technique [0002] At present, the basic principle of computer anti-malware program software for malicious programs is: first identify suspicious files and determine whether they belong to normal programs or malicious programs; The characteristics of malicious programs in the same family are extracted from their "pass-kill" features; the remaining samples that cannot extract "pass-kill" features extract "automatic" features to generate corresponding malicious program feature libraries. According to the generated malicious program signature database, the computer anti-malware program software scans the files in the client computer, and judges whether each file matches the malicious program signature in the signature database, and if it matches, it ...

AI Technical Summary

Problems solved by technology

[0004] For a large number of malicious program samples collected by computer anti-malware software manufacturers, different anti-malware software gives different classification results, and there is no uniform standard for naming rules. Even if the names are the same, they may not necessarily belong to the same family. , so the classification effect is not satisfactory

Images