A Visual Analysis Method of Malicious Code Based on Space Filling Curve

Abstract

The invention relates to a malicious code visualization analysis method based on a space-filling curve, comprising the following steps: generating a Hilbert graph and a Gray graph from the original file of the malicious code; generating a zigzag graph from the local entropy of the malicious code; The texture analysis method and the convolutional neural network extract the Gist features from the Hilbert image and the Gray image respectively, and implement classification based on the nearest neighbor principle, and use the VGG19 network to extract image features for the "Zigzag" image, and implement classification using the support vector machine . The invention can not only be used for detecting and classifying malicious codes, but also enables analysts to intuitively know whether a certain malicious sample has encryption or compression when analyzing malicious codes.

Description

technical field [0001] The invention relates to the technical field of malicious code visual analysis, in particular to a malicious code visual analysis method based on a space-filling curve. Background technique [0002] Extracting fingerprint features is a common method to identify malicious code. However, due to the rapid proliferation of malicious samples, if new fingerprint features are not updated in time, malicious code detection will be delayed. Traditional methods also include static and dynamic code analysis: static analysis is to check the control flow of the program through code disassembly to find malicious patterns; dynamic analysis is to run malicious code in a virtual environment and describe its properties through its behavior. However, the static method can only provide more comprehensive information when the malicious code does not use obfuscation techniques; the dynamic method can only observe the malicious behavior when the virtual environment meets the ...

AI Technical Summary

Problems solved by technology

[0004] Although the method of NatarajL, KarthikeyanS, JacobG, etal. Malware images: visualization and automatic classification [C]. International Symposium on Visualization for Cyber ​​Security. ACM, 2011: 1-7. can visually reflect that the malicious codes of the same family have similar patterns and textures, and have also obtained classification Better results, but this method has the following problems in the analysis of malicious samples: 1. The grayscale image generated by this method is proportional to the size of the original file of malicious samples. If the original file has a large amount of data, the large grayscale image file It will be misjudged by the system as a Decompression BombDosAttack (Decompression BombDosAttack), resulting in the termination of the analysis program; 2. The printable characters in the malicious code can prompt the function of the sample, but it cannot be seen from the representation of the grayscale image; and the malicious Code obfuscation technology is often used to hide its malicious activities, and the grayscale image cannot intuitively reflect whether the sample is encrypted or packed

Images