Decision model used for detecting malicious programs and detecting method of malicious programs

Abstract

The invention relates to a decision model used for detecting malicious programs and a detecting method of the malicious programs. The detecting method includes rule generation and machine learning algorithm training, the rule generation is characterized in that a training sample set composed of a 'malicious program' sample set and a 'non-malicious program' sample set is generated into a decision rule set in an API (application programming interface) calling layer, a basic abstraction layer and a business abstraction layer; the decision rule set includes an API calling layer decision rule, a basic abstraction layer decision rule and a business abstraction layer decision rule; the machine learning algorithm training is characterized in that an OCSVM algorithm training model is utilized to obtain an OCSVM algorithm model. The malicious program related detecting method is characterized in that the programs to be detected are subjected to decision by the aid of the related decision model. According to the technical scheme, multilevel and systematic features are achieved, false detection can be effectively controlled in the steps, and feasibility of application of the malicious program behavior detection in actual computer security is improved.

Description

technical field [0001] The invention belongs to the related fields of system security and network security, and further relates to a method for automatic analysis and detection of malicious programs. The invention utilizes a small number of samples of known malicious programs to automatically establish a rule base and a machine learning algorithm judgment module to detect unknown malicious programs with high accuracy through a multi-level and strictly controlled false detection judgment process. Background technique [0002] In the field of malicious program analysis and detection, in order to solve the problems of slow update of static feature codes, inability to cope with variants and confusing malicious programs, rule judgment or pattern recognition algorithms can be used to complete malicious program detection. [0003] The method and device for malicious file detection in Tencent Technology (Shenzhen) Co., Ltd.'s patent application "Method and device for detecting malic...

AI Technical Summary

Problems solved by technology

Although this method uses fuzzy reasoning to obtain the ability to judge variants and obfuscated malicious programs, the limitations of the rule judgment method itself, and the 7 program features used in this method are too simple, and its generalization ability cannot be effectively guaranteed.

[0005] In the document "Peng Hong, Wang Jun. Virus program detection method based on support vector machine [J]. Electronic Journal, 33(2), 276-278(2005)." Although this method can improve the detection ability of unknown malicious programs by using machine learning algorithms, the experimental results show that its false detection rate is high, and it is difficult to meet the strict requirements of low false detection rate in practical applications.

[0006] In summary, malicious program methods based solely on signatures, rules, or machine learning algorithms have their own shortcomings, such as insufficient generalization detection capabilities and insufficient false detection control capabilities.

Images