Malicious-code family determination method and device

Abstract

The invention discloses a malicious-code family determination method and device. According to the method, features of all malicious-code families are extracted and merged on the basis of analysis on all the existing malicious code families to generate a malicious-code family feature library, all extracted features of a to-be-tested sample are used to generate a feature vector according to a structure of the malicious-code family feature library, similarity calculation is carried out on the feature vector of the to-be-tested sample and all preset malicious-code family feature vectors, and whensimilarity meets a preset value, it is judged that the to-be-tested sample belongs to a corresponding malicious-code family. According to the method, various feature scalars are quantificationally combined into the feature vector, the sample is represented through the feature vector, operations of going deep into specific code layers and methods are not needed, computational resources are greatlysaved, and judgment accuracy is high; and calculation on the sample features is streamlined through calculation on the feature vector, and a processing rate is greatly improved.

Description

Technical field [0001] The present invention relates to the technical field of information security, in particular to a method and device for judging malicious code families. Background technique [0002] The rapid development of the mobile Internet in recent years has brought about increasing platform security problems. The Android platform is the most prominent. Under the appearance of the prosperity of its ecosystem, there is a hidden black industry chain driven by huge profits. The entire Android ecosystem is becoming more and more prosperous, and the black industry chain related to Android is becoming more and more rampant. There are more and more viruses on the Android platform, and the number has grown almost exponentially, but the number of malicious code families has grown very slowly. Under normal circumstances, a family often corresponds to a large number of samples. [0003] At present, the characterization of families mainly relies on the experience of virus analysis ...

AI Technical Summary

Problems solved by technology

[0003] At present, the characterization of families mainly depends on the experience of virus analysis engineers, which is very labor-intensive. At the same time, due to the differences in individual experience, differences in the identification of malicious code families are prone to occur.

In addition, the academic community currently judges family clustering mainly based on Android behavior. For example, using behavior to perform family clustering requires automatic triggering of applications, which is incomplete. On the other hand, dynamic triggering requires It consumes a lot of computing resources, and its own behavioral scalars are relatively small, which will lead to inaccurate classification

Images