Method for automatically detecting core characteristics of malicious code

Abstract

The invention discloses a method for automatically detecting core characteristics of a malicious code, and belongs to overall design of computer system security. The method is a method for detecting the core characteristics of the malicious code based on a machine learning algorithm. Due to static analysis, from the perspective of the actual security significance of the malicious code, image texture, key API calling and key character string characteristics of the malicious code are extracted; the extracted characteristics are learned through a random forest tree algorithm based on a normalizedbicharacteristic library; therefore, a family core characteristic library of the malicious code is obtained; for the malicious code, image characteristics of the malicious code have better expressiveforce; therefore, a bicharacteristic sub-library is constructed; the image characteristics of the malicious code are warehoused independently; the fact that certain characteristic values in image characteristic vectors can be selected for training in characteristic fusion every time can be ensured; and thus, a classifier obtained by training has a certain accuracy rate.

Description

technical field [0001] The invention relates to the field of computer security, in particular to a method for automatically detecting core features of malicious codes, which belongs to the overall design of computer system security. Background technique [0002] Malicious programs are a major threat in today's Internet. From classic computer viruses to network worms to botnets, all computer systems connected to the network are targeted for attack. This type of threat is mainly driven by the black industry, which systematically uses the compromised host to achieve illegal purposes, such as spreading spam and obtaining confidential data. Unfortunately, traditional security technologies, such as anti-virus scanning, have become less reliable in the context of the growing number and diversity of malicious programs, resulting in thousands of hosts on the Internet facing the threat of malware. How to automatically process and analyze malicious programs has become the focus of cur...

AI Technical Summary

Problems solved by technology

[0006] The present invention solves the problem of difficult feature extraction of malicious code families in the malicious code classification and detection process

Images