A method and device for realizing information classification

Abstract

A method and device for implementing information classification, comprising: representing functions contained in a Portable Executable (PE) file with bytecodes; preprocessing the functions represented by bytecodes to obtain samples for judging the similarity of functions Set information; based on the obtained sample set information, make a function similarity judgment; according to the judgment result of the function similarity judgment, make a function classification. The embodiment of the present invention realizes the automatic classification of functions, simplifies the function classification process, and unifies the function classification standards.

Description

technical field [0001] This article involves but is not limited to information security technology, especially a method and device for realizing information classification. Background technique [0002] With the development of the Internet, malicious codes are also constantly developing and evolving, and various new malicious code forms such as backdoors, Trojan horses, worms, and bots are gradually produced, which bring great challenges to the security of computers and networks. It has caused huge economic losses to enterprises and users, and seriously threatened the information security of the country. [0003] Fast and accurate classification of malicious codes is one of the keys to prevent malicious codes; currently, malicious code classification is mainly performed by skilled personnel in the field to extract and analyze the signatures of malware based on experience. When the number of malware samples is large, the analysis process is cumbersome , the efficiency is low...

AI Technical Summary

Problems solved by technology

[0002] With the development of the Internet, malicious codes are also constantly developing and evolving, gradually producing a variety of new forms of malicious codes such as backdoors, Trojan horses, worms, and bots, which have brought great challenges to the security of computers and networks. It has caused huge economic losses to enterprises and users, and seriously threatened the information security of the country

[0003] Fast and accurate classification of malicious codes is one of the keys to prevent malicious codes; currently, malicious code classification is mainly performed by skilled personnel in the field to extract and analyze the signatures of malware based on experience. When the number of malware samples is large, the analysis process is cumbersome , the efficiency is low, and there is a problem of inconsistent evaluation criteria

Images