Efficient detection method for massive malicious codes

Abstract

The invention discloses an efficient detection method for massive malicious codes, can realize efficient detection of massive malicious codes. According to assembler samples, malicious code detectionis conducted, the method adopts multi-core computing resources to execute steps of sample identification of assembler in parallel, the steps of sample identification of the assembler are as follows: assembler slices are extracted, the assembler slice is a statement or an expression that affects a specified variable in a assembler sample. Based on the preset assembler slice types, the number of occurrences of each type of assembler slice extracted from the assembler sample is counted, and is taken as a feature vector of the assembler sample. According to the feature vectors of the assembler samples, a classifier is obtained by pre-training, the malicious codes are identified by adopting the classifier.

Description

technical field [0001] The invention relates to the field of information technology, in particular to a method for efficiently detecting massive malicious codes. Background technique [0002] In today's cyberspace environment, with the rapid development of information technology and the increasingly widespread network applications, the situation of network security is becoming more and more severe. Network attacks are characterized by organization and industrialization. Fast, many types, a sharp increase in quantity, and a larger scale. [0003] According to statistics, nearly 2.05 million mobile Internet malicious programs were captured in 2016, and the number of malicious programs has maintained a rapid growth trend in the past seven years. [0004] In this context, how to quickly and accurately detect malicious code from a large number of applications has become a key problem that must be solved first to build a network security shield. [0005] At present, the research...

AI Technical Summary

Problems solved by technology

In addition, many assembly instructions in the assembly instruction set cannot effectively reflect the characteristics of malicious code, so the method of constructing the feature set through the combination of assembly instructions will seriously affect the analysis efficiency

[0007] (2) Traditional serial processing is less efficient

However, when faced with a large amount of malicious codes to be analyzed, if the traditional serial processing method is still used, the malicious codes need to be analyzed one by one, and it will be difficult to complete the detection task of massive malicious codes in a short time

In this way, it will be difficult to respond quickly when faced with an APT attack

Images