Clustering method and device of portable execute (PE) files

Abstract

The invention discloses a clustering method and device of portable execute (PE) files, and belongs to the field of network communication. The clustering method comprises the steps that features of the PE files are extracted, PE file identifications corresponding to the PE files are generated according to the features of the PE files, and the PE files are clustered according to the PE file identifications. The clustering device comprises an extraction module, a generation module and a clustering module. According to the features extracted from the PE files, the PE file identifications corresponding to the PE files are generated, the PE files are clustered according to the PE file identifications, and the clustering method and device of the PE files reduce the number of the PE files of a virus analysis end and a virus searching and killing server, cluster the irregular PE files to form regular categories, reduce storage cost, improve matching efficiency, and improve the capacity of resisting variant virus PE files and the early warning capacity.

Description

technical field [0001] The present invention relates to the field of network communication, in particular to a method and device for clustering portable executable files. Background technique [0002] With the development of the Internet, information has exploded, and the cycle of computer malicious programs such as computer viruses, worms, and Trojan horse programs is becoming shorter and shorter. Every day, a large number of viruses endanger the safety of users. Since most virus files are in the PE (Portable Executable, Portable Executable) file format, although the number of these virus PE files is large, many of them have similar characteristics. Conducive to virus analysis and killing. [0003] At present, the PE file clustering methods are mainly divided into two types: one is the traditional PE file clustering method, such as k-means clustering, hierarchical clustering, etc., first extracts some features of PE files, and then according to the extracted features Comp...

AI Technical Summary

Problems solved by technology

[0005] The first traditional PE file clustering method needs to align the extracted features when comparing two PE files. Due to the large differences of PE files, it is very time-consuming to perform alignment and multiple features need to be aligned. For comparison, the calculation complexity is very large, and when incrementally clustering new data, the original data needs to be clustered at the same time, and the cost of data storage and processing is high; the second method of clustering PE files based on fuzzy hash , depends on the segmentation of the PE file, the starting position of the PE file segmentation and the size of the segment will affect the hash value of the file, poor stability, poor comparability; and does not touch the internal information of the PE file, making many virus PE The file will generate variants by modifying its own structure, such as adding and deleting bits, and the result will be that its fuzzy hash values ​​​​are completely different and cannot be clustered

Images