Multi-model Malicious Code Detection Method Based on Confidence Probability Interval

Abstract

The present invention provides a multi-model malicious code detection system based on reliability interval. Each machine learning detection model corresponds to a distribution of the underlying data, and various threshold-based detection models can be integrated into the statistical platform of the present invention to realize the distribution of detection code data from multiple perspectives and alleviate the concept drift zone. model degradation problem. The detection system changes the prediction mode of 0 or 1 of the existing machine learning detection model, performs statistical analysis based on the scores calculated by the existing detection model, and establishes an order-preserving regression function for the score distribution of the samples and the labels of the samples. For unknown samples, according to the score given by the existing detection model and input the calculated protection regression function, the reliability probability interval predicted to be a certain label can be given. This probability interval can alleviate the fixed threshold on the training data set. Over-fitting problem, improve the adaptability of the detection model to the current dynamic data, and discover the concept drift phenomenon in advance.

Description

technical field [0001] The invention belongs to the technical field of computer antivirus. Background technique [0002] It is difficult for manual analysis to analyze such a large amount of newly added malicious codes in a timely manner, so machine learning technology has been widely applied to malicious code analysis and detection systems. However, driven by economic interests, the mutation and evolution of network security threats are getting faster and faster. While the number is increasing, more than 70% of new malicious code samples adopt self-protection techniques to evade machine learning, and some samples even Various evasion techniques are used. Therefore, the data distribution and saliency level of malicious codes are constantly changing over time, resulting in the detection model based on machine learning, compared with speech recognition models, face recognition models, text recognition models, etc., there is a serious problem of rapid aging. Contents of the ...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to solve the problem of concept drift faced by the existing botnet detection model based on static thresholds, and to provide a multi-model malicious code detection method based on the statistical learning confidence probability interval

Images