Operation code frequency-based malicious code visual analysis method

Abstract

The invention relates to an operation code frequency-based malicious code visual analysis method. The method comprises the following steps of extracting operation code character sequences of maliciouscodes, and converting the operation code character sequences into constant sequences; performing normalization operation on the obtained constant sequences; converting the normalized constant sequences into RGB values to obtain RGB color sequences; rearranging the RGB color sequences according to a specified sequence and then filling pictures; and according to the obtained pictures, performing visual analysis. The method can improve the analysis efficiency and is suitable for similarity comparison of malicious samples.

Description

technical field [0001] The invention relates to the technical field of malicious code analysis, in particular to a visual analysis method of malicious code based on operation code frequency. Background technique [0002] Malicious codes can steal, modify or destroy data on the system by exploiting computer system vulnerabilities, and even destroy the entire system, which is the biggest threat to the security of current information systems. Therefore, in order to allow security analysts to quickly identify the nature of newly added suspicious files, introducing visualization technology into the field of malicious code analysis and taking advantage of the advantages of image classification in the field of artificial intelligence to solve the problem of malicious code classification is a frontier hotspot in current network security research. [0003] In 2013, KyongSoo Han et al. of Hanyang University in South Korea proposed the method of image matrix, which converts the binary ...

AI Technical Summary

Problems solved by technology

[0004] However, the method of Han K S, Lim J H, Im E G. Malware analysis method using visualization of binary files [C]. Research in Adaptive and Convergent Systems. ACM, 2013: 317-321. only selects part of the image matrix to calculate the similarity, And only 9 samples of the three types of malicious code families are analyzed, which makes it lack of universality in application; at the same time, in view of the uniqueness of the hash value, only identical basic blocks can appear in the image matrix with the same color The same position of the same malicious code, but the basic blocks that implement the same malicious function are not necessarily composed of the exact same opcode sequence, which will cause the image matrix generated by the same family of malicious code that implements similar functions to be visually dissimilar

Images