A fast classification method of malicious code based on family gene code

Abstract

The invention discloses a rapid classification method of malicious codes based on family genetic codes. The method comprises performing character representation on the malicious codes by using behavior appearance frequencies on multiple behavioral aspects, generating the family genetic codes based on aggregation and difference among massive malicious code samples, and exactly and rapidly classifying the malicious codes by using the direct match between the family genetic codes and the added malicious code feature vectors. The method has the advantages that the action information of the malicious codes is described from multiple behavioral aspects, the family genetic codes are generated by using the aggregation and difference among similar malicious code samples, the exactness and universality for representing the malicious code family can be obviously improved; simultaneously, through the method of directly matching the malicious code feature vectors and the family genetic codes, the comparison and classification speed of the malicious codes can be effectively improved; furthermore, the algorithm of the whole process is highly automatic without human intervention; the stability and accuracy of the method are increased.

Description

technical field [0001] The invention relates to computer safety protection technology, in particular to a computer malicious code classification method. Background technique [0002] With the progress of society and the development of technology, computers have penetrated into all aspects of people's lives, and more and more personal information (such as pictures, videos, chat records, etc.) and sensitive information (such as bank account numbers, business information, etc.) are stored in the computer. At the same time, in recent years, the number of malicious codes whose main purpose is to embezzle and destroy these information has increased sharply, and it has many varieties and intelligent characteristics, which makes the identification and classification of computer malicious codes arouse the great attention of governments and people in various countries. . [0003] The existing malicious code classification methods mainly start from the static or dynamic characteristi...

AI Technical Summary

Problems solved by technology

[0003] The existing malicious code classification methods mainly start from the static or dynamic characteristics of malicious code, and most of them focus on the clustering and classification of known malicious code, and the classification effect on newly added malicious code is poor. The form of feature analysis is single and the number of samples is small, which lacks accuracy and universality

Images