Malicious code classification method based on convolutional neural network

Abstract

The invention discloses a malicious code classification method based on a convolutional neural network. According to the method, malicious codes are mapped into single-channel signals, then a spectrogram of the signals is generated according to a signal processing method, an image scaling algorithm is used to convert the spectrogram into a grayscale map of a constant size, and finally the convolutional neural network is used to realize classification of the malicious codes. Through the method, the corresponding spectrogram is generated after the malicious codes are mapped into the signal-channel signals, sufficient context information of the malicious codes can be obtained, and the context information not only reflects time domain and frequency domain information of the signals but also can reflect local and global information of the signals; and besides, thanks to local translation invariance and other characteristics of the convolutional neural network, substantive characteristics ofthe malicious codes can be well obtained, code rearrangement, garbage code insertion and other situations are effectively overcome, and classification precision of the malicious codes is improved.

Description

technical field [0001] The invention relates to the field of malicious code classification, in particular to a method for classifying malicious codes based on signal analysis. Background technique [0002] With the vigorous development of the Internet, malicious code has become one of the main factors threatening Internet security, and it shows a trend of rapid growth. The static analysis method of malicious code is one of the commonly used methods to classify and identify malicious code. The static analysis method in the prior art includes the analysis method based on the image characteristics of malicious code. For example, Nataraj L et al. proposed a SPAM-GIST malicious Code classification method (Nataraj L, Manjunath B S. SPAM: Signal Processing to Analyze Malware[Applications Corner][J]. IEEE Signal Processing Magazine, 2016, 33(2):105-117), which maps malicious code binaries to images To describe the features, use the multi-scale and multi-directional characteristics ...

AI Technical Summary

Problems solved by technology

[0003] The present invention provides a malicious code classification method based on a convolutional neural network, which solves the problem that the malicious code classification technology in the prior art cannot effectively identify confused malicious codes, thereby resulting in low accuracy of malicious code classification

Images