A method and system for detecting malicious code based on deep learning

Abstract

The invention discloses a malicious code detection method and system based on deep learning. The method comprises the steps that characteristics in codes are extracted, effective characteristics are selected, and then a first Burt characteristic vector is formed according to whether a training sample code contains the effective characteristics or not; the characteristics of a code to be detected are extracted, and a second Burt characteristic vector is formed according to whether the code to be detected contains the effective characteristics in a training stage; the first Burt characteristic vector is input into the training stage to structure a depth confidence network model, the second Burt characteristic vector is input into the depth confidence network model in a detection stage, and whether the code to be detected is a malicious code or not is judged according to the output result of the model. According to the method, the semi-supervision training learning model in deep learning is adopted, a large scale of mark-free collection code samples are used for training, and thus the time for marking a large quantity of samples can be saved; besides, the model can accurately judge known malicious codes and accurately predict unknown malicious codes.

Description

technical field

[0001] The present invention relates to the field of mobile terminal applications, in particular to a method and system for detecting malicious codes based on deep learning. Background technique

[0002] With the explosive growth of malicious code, malicious code has become the biggest cause of personal and corporate information leakage, so it is necessary to detect malicious code before it runs. At present, there are relatively mature malicious code detection technologies, mainly based on signatures, signatures, and heuristics.

[0003] The signature-based malicious detection method generates a mark for various malicious codes, and uses these marks to construct a malicious code database. This method can quickly detect whether a piece of code is malicious code, and has a high accuracy rate for the types of samples already in the database. It is the main method adopted by many commercial antivirus software.

[0004] However, this method has the following dis...

Images