Malicious program dynamic identification method based on decision-making tree model

Abstract

The invention discloses a malicious program dynamic identification method based on a decision-making tree model. The method comprise the steps of 1, establishing a behavior collection sandbox module; 2, collecting black and white samples to form a training sample set; 3, capturing all behaviors generated when samples are operated; 4, calculating and combining feature identification nodes and behavior vectors of various behaviors of white samples to obtain a white vector set; 5, calculating and combining the feature identification nodes and the behavior vectors of the various behaviors of black samples to form a black vector set; 6, training the white vector set, the black vector set and a machine learning model to generate a decision-making tree; 7, capturing complete behaviors based on unknown sample programs according to a sandbox; 8, calculating behavior feature identification of the unknown samples; 9, calculating the behavior vectors of the samples and inputting the behavior vectors into the decision-making tree for identification; and 10, outputting sample identification results by the decision-making tree. Through adoption of the steps, a malicious program dynamic identification purpose is achieved through utilization of the decision-making tree model, and the problem that the efficiency is low and a process is complex in a malicious sample analysis process is solved.

Description

[0001] 1. Technical field [0002] The invention provides a malicious program dynamic identification method based on a decision tree model, which relates to a dynamic malicious program detection and identification method and belongs to the field of information security. [0003] 2. Background technology [0004] With the popularization and development of the Internet, the dissemination and utilization of malware such as Trojan horse programs, downloaders, ransomware, and malicious macro files are also intensifying. A piece of malware may cause great harm to enterprises or users. Therefore, how to use Efficient and accurate identification has become a key point of computer security defense. [0005] The current detection methods mainly adopt signature-based detection and killing and heuristic artificial characteristic behavior detection and killing, that is, through manual analysis to identify the security of signature files, and extract representative malicious signatures or ma...

AI Technical Summary

Problems solved by technology

[0011] The purpose of the present invention is to provide a dynamic identification method for malicious programs based on a decision tree model, so as to realize intelligent and efficient analysis and identification of malicious programs, and solve the problem of complex identification process of existing malicious programs, low efficiency of manual analysis, and certain detection blank period in the identification method As a result, new types of malicious programs cannot be identified in a timely and effective manner, and developers of malicious programs hide malicious features by modifying them to cheat and bypass detection

Images