Multi-model malicious code detection method based on reliability probability interval

Abstract

The invention provides a multi-model malicious code detection system based on reliability probability interval. Each machine learning detection model corresponds to a distribution of the underlying data, and various threshold-based detection models can be integrated into the statistical platform, so that the distribution of the semantic code data is detected from the multi-angle view, and the model degradation problem caused by the concept drift is relieved. The detection system changes the prediction mode of 0 or 1 of the existing machine learning detection model, calculates the score based on the existing detection model, carries out statistical analysis, and establishes a isotonic regression function for the score distribution of the sample and the label of the sample. For an unknown sample, according to the score given by the existing detection model, the calculated isotonic regression function is input, the reliability probability interval of a certain label can be given, and theprobability interval can relieve the problem of over-fitting of the fixed threshold to the training data set, the adaptive ability of the detection model to the current dynamic data is improved, and the concept drift phenomenon is found in advance.

Description

technical field [0001] The invention belongs to the technical field of computer antivirus. Background technique [0002] It is difficult for manual analysis to analyze such a large amount of newly added malicious codes in a timely manner, so machine learning technology has been widely applied to malicious code analysis and detection systems. However, driven by economic interests, the mutation and evolution of network security threats are getting faster and faster. While the number is increasing, more than 70% of new malicious code samples adopt self-protection techniques to evade machine learning, and some samples even Various evasion techniques are used. Therefore, the data distribution and saliency level of malicious codes are constantly changing over time, resulting in the detection model based on machine learning, compared with speech recognition models, face recognition models, text recognition models, etc., there is a serious problem of rapid aging. Contents of the ...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to solve the problem of concept drift faced by the existing botnet detection model based on static thresholds, and to provide a multi-model malicious code detection method based on the statistical learning confidence probability interval

Images