Method and system for detecting sample relevance based on label propagation

Abstract

The invention discloses a method and system for detecting sample relevance based on label propagation. The method comprises the steps that a sample set is acquired; characteristics and relevance degrees of the sample set in each dimension are calculated; samples and sample characteristics are taken as nodes; a relevance network diagram is established by connecting lines and enclosing edges of the samples and the nodes which have the relevance; characteristics of a to-be-detected sample are acquired and imbedded into the relevance network diagram; a multiplying product of weights of the to-be-detected sample in the new relevance network diagram and samples on each connecting line is calculated; and the samples on the corresponding connecting lines are output if the multiplying product exceeds a preset value. By the method disclosed by the invention, more information can be judged according to codes and sample attributes; relevance relations are more accurate; and enlightenment effects are better. The method has the advantages that the samples with the relevance can be effectively output and used to further judge whether the to-be-detected sample is a counterfeit document; and the method can assist in detection of malicious codes.

Description

technical field [0001] The invention relates to the field of network security, in particular to a sample correlation detection method and system based on label propagation. Background technique [0002] At present, most of the detection of sample relevance requires in-depth code analysis, which is difficult, and it is only based on the code level, which is not very enlightening, because some counterfeit applications may not directly counterfeit from the code level, but use Resource files of genuine applications, such as icons, program names, package names, etc.; another example is that the same criminal group has written two malicious codes with completely different functions, but both use the same email address to upload user privacy information. We can find two malicious codes through this email address. It is more difficult to analyze the relevance of class applications through code analysis. Contents of the invention [0003] The present invention proposes a sample re...

AI Technical Summary

Problems solved by technology

[0002] At present, most of the detection of sample relevance requires in-depth code analysis, which is difficult, and it is only based on the code level, which is not very enlightening, because some counterfeit applications may not directly counterfeit from the code level, but use Resource files of genuine applications, such as icons, program names, package names, etc.; another example is that the same criminal group has written two malicious codes with completely different functions, but both use the same email address to upload user privacy information. We can find two malicious codes through this email address. The relevance of class applications, but it is more difficult to analyze its relevance through code

Images