Method and device for detecting malicious software, computer device and readable storage medium

Abstract

The embodiments of the invention disclose a method and a device for detecting malicious software, a computer device and a readable storage medium, which relate to the field of network security and are used to improve the accuracy of malicious software detection. The method provided by one embodiment of the invention comprises the following steps: acquiring network traffic generated by multiple pieces of malicious software; clustering the multiple pieces of malicious software in a coarse-grained manner based on the statistical characteristics of the network traffic to get a first clustering result; clustering each type of malicious software in the first clustering result in a fine-grained manner based on the content characteristics of the network traffic to get a second clustering result; and generating a signature for each type of malicious software in the second clustering result so as to detect malicious software according to the signatures.

Description

technical field [0001] The invention relates to the field of network security, in particular to a malicious software detection method and device, a computer device and a readable storage medium. Background technique [0002] Malware refers to viruses, worms, and Trojan horse programs that perform malicious tasks on computer systems, exercising control by disrupting software processes. At present, malicious software is rampant, and these malicious software contain various malicious behaviors, which cause security problems such as privacy disclosure and economic loss of users. [0003] To keep your network safe, you need to find reliable ways to detect malware. The current detection method for malware is to detect the HTTP communication traffic of malware. Specifically, it is based on the URI and domain name detection method. It actively collects malicious URI and domain names to form a blacklist, or extracts traffic through automated analysis of malware. The URIs in constit...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides a malicious software detection method and device, a computer device and a readable storage medium, which are used to solve the problem of low accuracy of the malicious software detection method provided by the prior art

Images