Malicious code obfuscation feature cleaning method

Abstract

The invention discloses a malicious code obfuscation feature cleaning method, and belongs to the field of machine learning information safety. The method involves a feature selection method and an obfuscation feature cleaning method, and the effectiveness of a traditional malicious code feature extracting method is improved. Compared with the traditional malicious code feature extracting method, the malicious code obfuscation feature cleaning method can effectively prolong the effective time limit of a malicious code feature extracting algorithm, and improve the interference resistance of thefeature extracting algorithm. Firstly, a feature library is built through an n-gram feature extracting method. Since the feature extracting algorithm cannot solve the obfuscation operation problem ofmalicious codes, the feature library contains a large number of obfuscation feature values of the malicious codes. Through an obfuscation feature cleaning algorithm, the interference of abnormal datain a model identification rule can be removed. On this basis, from the aspect of the scale of a training dataset, a feature selection method is put forward. By means of the malicious code obfuscationfeature cleaning method, on the basis of guaranteeing that the model identification precision is not lowered, the number of features which are finally used in the model is effectively lowered.

Description

technical field [0001] The invention relates to a malicious code obfuscation feature removal method, which can improve the effective time limit of the traditional malicious code feature extraction method. It belongs to the field of machine learning information security, and involves the combination and use of machine learning classification algorithms and confusing feature removal and feature selection algorithms. Background technique [0002] According to Symantec statistics, most of the new malicious codes are generated after some transformation operations on the basis of the original malicious codes. Therefore, malicious code detection is usually based on feature vectors, which identify the essential characteristics of malicious codes. A good feature extraction algorithm is the core technology of malicious code variant detection. Common antivirus software usually uses a signature-based approach to identify malicious code. For a given set of malicious code samples, the ...

AI Technical Summary

Problems solved by technology

However, this method is based on the detection method of the program behavior itself, and does not take into account the problem of the program's calling of resources, so it cannot be well identified for some special variants of malicious code

Moreover, this method has poor timeliness, requires large computing resources, and is not practical

[0004] With the acceleration of malicious code iteration speed, the timeliness of feature extraction methods is getting shorter and shorter.

It becomes more and more difficult to maintain the security of the system by changing the feature extraction method

Images