Malicious-software characteristic clustering analysis method and system based on behavior segment sharing

Abstract

The invention discloses a malicious-software characteristic clustering analysis method and system based on behavior segment sharing. The malicious-software characteristic clustering analysis method comprises the following steps of: distributing acquisition and analysis nodes, establishing a distribution type hash table module, segmenting behaviors of an acquired malicious software sample into behavior segments, and storing the behavior segments to a hash table; and carrying out statistics on the global characteristics of the segments, returning the global characteristics to the acquisition and analysis nodes which construct a characteristic vector of the malicious software sample, carrying out clustering, and extracting the characteristics and the attributes of the clustering as a comprehensive analysis result and inputting the result. The system comprises a plurality of acquisition and analysis nodes which comprise a behavior-segment segmenting module, the distribution type hash table module, a behavior-segment synergy sharing module, a malicious-software sample representation module, a malicious-software sample local clustering module and a malicious-software sample local analysis module. The invention has the advantages of high analysis accuracy, strong analysis performance and good expandability.

Description

technical field [0001] The present invention relates to the technical field of computer network security, in particular to a malware feature clustering method based on behavior segment sharing for how to realize efficient interactive information for collection and analysis nodes distributed in various parts of the network so as to accurately cluster and analyze local malware samples. Class analysis method and system. Background technique [0002] According to the definition of terms in the Internet Security Threat Report of the National Internet Emergency Center, malware refers to programs that are installed and executed in information systems without authorization to achieve improper purposes. Malicious software mainly includes: 1) Trojan horse (Trojan Horse), malicious software with the main goal of stealing user's personal information, and even remote control of user's computer. 2) Bots, malicious software used to build large-scale attack platforms. According to the com...

AI Technical Summary

Problems solved by technology

Such a huge malware sample poses a huge challenge to the malware detection system to correctly identify, classify, and describe malware

2) The behavior of malware shows a stronger diversity. Through technologies such as message encryption, changing transmission channels, and polymorphism, different samples of the same malware show different behaviors, and it is difficult to correctly identify the observed malware samples. effective analysis

3) Malware samples are widely distributed in space and have high concealment, so the number of samples of the same malware that can be observed in a single LAN or enterprise network is very limited

However, the method of reducing the attribute dimension of malware and reducing the amount of analysis can only alleviate the computational bottleneck of the centralized system to a limited extent, but cannot fundamentally solve the computational bottleneck of analyzing malware.

[0006] To sum up, for network-based malware detection, the current single-point collection and analysis technology has the defects of limited collection of malware samples, low analysis accuracy and effectiveness; while distributed collection and centralized analysis technology has the disadvantages of computing and communication bottleneck

Moreover, both malware analysis techniques rely on human experts and cannot support intelligent automatic analysis

Images