Malicious code analysis method and system based on semi-supervised learning

Abstract

The present invention discloses a malicious code analysis method based on semi-supervised learning. The method is characterized in that analysis is carried out based on the multi-dimensional features, and static features and dynamic features of a malicious code are extracted; and the difficulty of the subsequent processing through dimensionality reduction is reduced, and by using the semi-supervised learning method, the problem of the classification of a small number of marked malicious code samples is solved.

Description

technical field [0001] The present invention relates, in particular, to . The invention relates to malicious code analysis technology, in particular to a method and system for analyzing malicious code based on semi-supervised learning. Background technique [0002] Malware is any computer software that is potentially harmful to computers and networks. At present, the number and types of malicious codes are increasing year by year, and the production technology is developing rapidly, which poses a huge threat to the security of the global network environment. The pattern matching method is widely used in the commercial field, but it is powerless for the variant detection of malicious code. Nowadays, learning methods based on supervised learning, unsupervised learning, and semi-supervised learning have been adopted to solve the detection problem of malicious code variants and have mature research results in algorithms. This invention studies malicious code from the perspecti...

AI Technical Summary

Problems solved by technology

[0004] It can be seen that most of the existing research results on malicious code classification technology extract a single feature type, which will make it difficult to describe all the properties and characteristics of malware codes and behaviors.

In addition, in the study of malicious code classification that extracts multiple features, the feature selection and feature extraction parts are not discussed in detail. High-dimensional features will reduce the classification efficiency and are prone to overfitting.

In addition, the current malicious code classification based on supervised learning cannot solve the problem of a small number of labeled samples.

Images