A malicious code detection method and system based on multi-feature fusion

Abstract

The present invention discloses a malicious code detection method and system based on multi-feature fusion, wherein the detection method includes: step A: extracting N-gram and variable-length N-gram of the code sequence in the training set and the test set, respectively as The basic feature set of the training set and the basic feature set of the test set; step B: filter out the effective feature set of the training set and the effective feature set of the test set from the extracted basic feature set of the training set and the basic feature set of the test set by means of information gain ; Step C: Perform feature fusion on the selected effective feature set of the training set by Boosting algorithm to obtain a fusion feature classifier; Step D: Use the fusion feature classifier to detect the screened effective feature set of the test set. The detection method provided by the present invention makes the finally obtained fusion features have stronger discrimination and robustness, and can better classify malicious codes.

Description

Technical field [0001] The invention relates to the technical field of malicious code detection, in particular to a method and system for malicious code detection based on multi-feature fusion. Background technique [0002] Unwanted code refers to code that has no effect but can bring danger. Definition 1: Malicious code is also called malware. These software can also be referred to as adware, spyware, or malicious shareware. They are installed on the user’s computer or other terminal without explicitly prompting the user or without the user’s permission. Software that runs and violates the legitimate rights and interests of users is sometimes called rogue software. Definition 2: Malicious code refers to computer code that is deliberately programmed or set to cause threats or potential threats to the network or system. The most common malicious code includes computer viruses (referred to as viruses), Trojan horses (referred to as Trojan horses), and computer worms ( Referred to...

AI Technical Summary

Problems solved by technology

The traditional feature-based malicious code detection method needs to fit the training set for feature selection, and the selected features are too easy to fit the training set, resulting in a better detection effect on the training set. Detection on the test set, the classification effect is often not satisfactory

Images