Local entropy-based visualized analysis method for malicious codes

Abstract

The invention relates to a local entropy-based visualized analysis method for malicious codes. The method comprises the following steps of: calculating local entropy of a malicious code, recording a sequence length of the generated entropy value as L, and supplementing 0 entropy values; calculating a djb2 hash value of the local entropy; converting the djb2 hash value into an RGB value; generatinga square graph of the local entropy on the basis of an RGB value sequence; and extracting Gist features of the square graph of the local entropy, and carrying out classification and verification by using a KNN algorithm. The method can be used for malicious code detection and classification.

Description

technical field [0001] The invention relates to the technical field of visual analysis of malicious codes, in particular to a method for visual analysis of malicious codes based on local entropy. Background technique [0002] Malicious code writers usually use automated means to develop malicious code variants, causing their number to increase rapidly, which greatly endangers the security of information systems. The automatic development method often reuses the core functional modules of the same family of malicious codes, and the similarity of these modules can be reflected in the form of local entropy, which provides a favorable basis for identifying malicious code families. [0003] In 2015, KyongSoo Han et al. of Hanyang University in South Korea proposed an entropy map method, which calculates the entropy value of each 256-byte block in malicious code to generate a histogram of local entropy, and then uses the histogram comparison algorithm (Strelkov V V.A new similari...

AI Technical Summary

Problems solved by technology

1. Because the length of the entropy graph is affected by the size of the malicious code file, there are differences, so only part of equal-length regions can be intercepted to calculate the similarity, which makes the features used for classification incomplete; 2. The histogram based on the maximum entropy value as the basis for interception The graph similarity algorithm cannot accurately locate the comparison range in the local entropy area formed by similar functional modules, so it cannot meet the classification premise of this method, that is, similar modules can be used to detect malicious variants

These factors affect the accuracy of this method in the application of malicious code classification

Images