Malicious code detection and recognition method and device based on software genes

Abstract

The invention relates to the field of malicious code analysis technology, in particular to a malicious code detection and recognition method and device based on software genes. According to the method, the software genes of malicious codes are defined and extracted, software genomes of the malicious codes are constructed, a gene mode based on graph structure expression is constructed for each malicious code according to software gene calling relations of different malicious codes, a malicious code software gene bank is established through learning of existing samples, and therefore a good detection accurate rate and a low false report rate are obtained. By coding different software genes, the software genes are combined into the software genomes, the software genomes are information sets of the malicious codes, the gene modes are expressed with a graph structure, overall characteristic information of the malicious codes can be represented, and the gene modes are material sets of the malicious codes. Through the malicious code detection and recognition method and device, the information property and the material property of the software genes are achieved at the same time, and genetic characteristics and mutation characteristics are well represented.

Description

technical field [0001] The invention relates to the technical field of malicious code analysis, in particular to a software gene-based malicious code detection and identification method and device. Background technique [0002] Today's society has entered the information network age of "everywhere online, everywhere interconnected". People's production and life, social politics, economy, national stability and security are all impossible to talk about without cyberspace security. Malicious code, as an important source of cyberspace security threats, is increasingly "generalized" and "multi-sourced". Its threat targets expand from hosts and servers to mobile terminals, industrial control systems, and even wearable devices, and the number is increasing rapidly The detection, identification and analysis of malicious code has always been one of the important research topics in the field of cyberspace security. [0003] Traditional malicious code detection and identification tec...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the problem that the detection accuracy cannot be effectively guaranteed in the current malicious code detection process, the present invention proposes a malicious code detection and identification method and device based on software genes, providing support for gene matching in the malicious code analysis and detection process

Images