Machine Learning Method and System Based on Context Awareness

Abstract

Embodiments of the present invention provide a context-aware-based machine learning method and system, which relate to the field of information security technology and are used to solve the problem in the prior art that a machine learning model is used to detect unknown threats with a high false alarm rate. The method includes: Obtain the file statistical information of the file, and determine the file to be detected for machine learning detection according to the file statistical information; the above-mentioned files include at least: static files and process files; obtain the context information of the file to be detected and the file to be detected. Learn and detect the machine learning model file features; determine the machine learning model used to detect the file to be detected according to the context information, and input the machine learning model file features into the machine learning model to detect whether there is an unknown threat in the file to be detected. The invention can reduce the false alarm rate of detecting unknown threats by adopting the machine learning model, and improve the detection rate of unknown threats.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a machine learning method and system based on situation awareness. Background technique [0002] With the rapid development of digital technology, network security threats are also growing rapidly, especially more and more viruses use 0-day loopholes (has been discovered and undisclosed loopholes) to spread rapidly, making the speed and quantity of virus mutations as fast as How to deal with unknown threats among network security threats is facing severe challenges. [0003] Currently, virus detection for network security threats can be implemented based on signature matching or machine learning model detection. In practice, virus detection based on signature matching extracts signatures from virus samples and detects known viruses through signature matching. Although it has a very low false positive rate, it cannot cope with unknown viruses that spread thro...

Images