A malicious code classification method based on multiple features and feature selection

Abstract

The invention relates to a malicious code classification method based on multiple features and feature selection, belonging to the technical field of computer security and machine learning. The invention relates to a method for obtaining multi-features by fusing features of different classes of malicious code family, and a feature selection method for processing the multi-features, in particular,the method comprises the following steps of fusing pixel features and n-Gram features, the multi-feature information representing the malicious code family is obtained, the initial feature selection of the fusion feature is carried out by using the logistic regression model with L1 regular term optimized by L2 regular term, and then the feature dimension is reduced by using linear discriminant analysis, finally the malicious code classifier is trained by using K nearest neighbor algorithm. The invention can provide more dimensional characteristic data for the training process, and can solve the problem that the key features cannot be selected; by using LDA to reduce the dimension of features, the mapped samples have better classification performance, which not only accelerates the trainingspeed, but also improves the classification accuracy of the model.

Description

technical field [0001] The invention relates to a malicious code classification method based on multiple features and feature selection, and belongs to the technical fields of computer security and machine learning. Background technique [0002] With the development of malicious code technology, malicious codes began to deform in the process of spreading to avoid detection and killing. At present, the number of variants of the same malicious code has increased sharply, and the shape has also changed greatly compared with the main body. The detection of malicious codes Security and prevention are major challenges in the security field. [0003] Malicious code refers to all malicious programs designed to destroy the reliability, usability, security and data integrity of computer or network systems or consume system resources. With the gradual development of anti-malicious code technology, active defense technology and cloud detection and killing technology have been increasin...

AI Technical Summary

Problems solved by technology

[0005] However, the effect of the malicious code classification method based on machine learning depends largely on the extracted features of the malicious code family. Too few features cannot fully represent the type of malicious code family, and too many features will not only slow down the training Decrease, it will also produce the effect of restricting classification by problems such as overfitting

Images