Method for detecting unknown malicious code

Abstract

The invention discloses a method for detecting an unknown malicious code in the technical field of information safety, which can detect the malicious code in a file in advance under the situation that a malicious code library is not updated. The method comprises the following steps: extracting the feature vector of a file in a training set by utilizing a Byte n-grams method; carrying out the dimension reduction to the extracted feature vector of the file in the training set by adopting a local linear embedding algorithm; taking the feature vector after being subjected to dimension reduction as input, training a kernel cover classifier by utilizing a kernel cover learning algorithm; extracting the feature vector of the file in a test set by utilizing the Byte n-grams method again; carrying out the dimension reduction to the extracted feature vector of the file in the test set by adopting the local linear embedding algorithm; inputting a result after being subjected to dimension reduction into the kernel cover classifier for classification; and calculating the classification result and determining whether the file in the test set contains the malicious code. With the adoption of the method, the detection speed of the file is improved, and the advanced accuracy detection of the malicious code is realized.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a method for detecting unknown malicious codes. Background technique [0002] At present, malicious codes are ubiquitous on the Internet, and their dissemination, harm, and concealment are constantly improving, so that the detection of computer malicious codes is facing a huge challenge. There are two main types of existing computer malicious code detection technologies, one is the pattern matching technology based on signatures, and the other is the detection technology based on malicious code behavior rules. [0003] The signature-based pattern matching technology is to manually analyze the malicious code file after it appears, extract the signature that can uniquely identify the malicious code file, and upgrade the signature to the malicious code signature database, and then The feature code library is provided to the user to detect and kill malicious...

AI Technical Summary

Problems solved by technology

The disadvantage of the above two detection methods is that the malicious code database must be constantly updated, otherwise new types of malicious code can bypass detection

In addition, these two technologies are post-event detection technologies, which cannot detect new malicious codes before they are executed. Only when malicious codes appear, the analysts will extract their features and update their signatures to the feature database. , to detect

During this time, however, malicious code could have been executed and caused damage

Images