A Visual Analysis Method of Malicious Code Based on Shannon Information Entropy

Abstract

The invention provides a malicious code visualized analyzing method based on the Shannon information entropy. The method includes the steps that firstly, the binary bytes of a malicious file are converted into yellow brightness values of pixel points of a pixel map, and the points with the pixel value being Ox20-Ox7E are marked through a green channel Ox50; secondly, the local entropy of the pixel value in each 256-byte block in the pixel map is calculated based on the pixel value of the pixel map, and the local entropy is calculated according to the following Shannon information entropy formula: Entropy=- *log2pi, wherein the pi represents the occurrence probability the byte (pixel) value i, the value of the i ranges from Ox00 to OxFF, and the Entropy is the local entropy. The f (Entropy) value of the local entropy value Entropy is calculated according to the formula: f (Entropy) = 2<Entropy>-1, and the entropy diagram is generated through the calculation result of the f (Entropy); thirdly, normalization processing is conducted on the calculation result of the f (Entropy), and an entropy normalization diagram is generated. By means of the malicious code visualized analyzing method based on the Shannon information entropy, samples of various groups can be effectively distinguished, when the malicious codes of the same group are analyzed, the potential distinctions can be found much easier, and a basis is provided for mastering the variant evolution law of the group.

Description

technical field [0001] The invention relates to a malicious code visualization analysis method based on Shannon information entropy. Background technique [0002] Malware (Malicious Software) is a software used to destroy computer operating systems, steal sensitive information, or illegally access private systems, usually in the form of code, scripts, dynamic text, or other software. Due to the complex and time-consuming traditional malware analysis process, it is difficult for even experienced security analysts to discover potential attack modes. In order to reduce the cognitive burden and improve interactivity, introducing information visualization technology into the field of malicious code analysis, that is, Malware security visualization, is the frontier hotspot in network security research in recent years. [0003] In 2008, Gregory Conti of the United States Military Academy West Point et al. designed a visual analysis system (such as figure 1 ) for the first time pr...

AI Technical Summary

Problems solved by technology

[0004] However, in terms of analyzing file similarity for classification research, the method of Gregory Conti, Erik Dean, Matthew Sinda and Benjamin Sangster.Visual Reverse Engineering of Binary and DataFiles[C].VizSec 2008Symposium on Visualization for Cyber ​​Security(VizSEC2008) makes the calculation amount and The size of the file is proportional to the size of the file, and the degree of automation of the analysis is restricted by the performance of the computer hardware. At the same time, in terms of presenting the internal characteristics of the file, the pixel value of the c area corresponding to the byte is separated from the b area reflecting the existence of the ASCII code value. Facilitates a comprehensive understanding of the characteristics of the analyzed files

Images