Network behavior characteristic clustering analysis-based malicious code detection method

Abstract

The invention provides a network behavior characteristic clustering analysis-based malicious code detection method, which comprises the following steps: Step 1, mainly performing characteristic analysis on a zombie network and a Trojan network; Step 2, performing network characteristic extraction by use of an MFAM-NB (Magnetic Random Access Memory-Narrow Band) framework; and Step 3, detecting a malicious code by use of an adaptive weight-based k-Means clustering algorithm. The method can solve the problem that a malicious network can easily change package contents and stream characteristics toavoid detection of the malicious code and can solve the problem of dependency of a traditional malicious code detection method on manual characteristic extraction. The adaptive weight-based k-Means malicious code detection algorithm adopted in the method can solve the problem of inaccurate detection of the malicious code due to inappropriate selection of the traditional k-Means algorithm for an initializing center and can solve the problem of long time of the k-Means algorithm for processing a characteristic set with a large data volume.

Description

technical field [0001] The invention relates to a malicious code detection method. Background technique [0002] With the rapid advancement of network information technology, people are particularly dependent on computers in terms of life, education and medical care. The open computer platform enables everyone to obtain the information they need from the Internet. People can use the Internet at will and publish information through the platform. It is this absolute freedom that leads to increasingly serious information security problems. Driven by profit, more and more developers are constantly investing in the research and development of malicious code. These malicious codes have seriously affected the development of the entire country, and even the entire world, both in terms of economy and life. [0003] Malicious codes have caused huge economic losses to entire countries in cybersecurity incidents. Malicious code mainly includes botnets, worms, Trojan horses, logic bo...

AI Technical Summary

Problems solved by technology

However, there are still many disadvantages and defects in the traditional detection methods, for example, for malicious code variants, packing and other deformation methods, its detection efficiency and accuracy are not ideal

[0004] Although the traditional malicious code detection technology can detect malicious code to a certain extent, it still relies on manual feature analysis.

Images