Multi-model cross detection of malicious code based on statistical learning

Abstract

The invention provides a multi-model cross detection of a malicious code based on statistical learning, which can be well applied in the field of malicious code detection. This method introduces credibility, solves the problem of isolation among machine learning models, and provides a platform for machine learning models to learn from each other. In addition, on the fine-grained statistical learning platform, multiple machine learning models statistically analyze the mutation process of malicious code from different perspectives, alleviate the degradation problem of a single model, and use APValgorithm to identify concept drift phenomenon, so as to achieve common defense of multiple models.

Description

technical field [0001] The invention belongs to the technical field of computer antivirus. Background technique [0002] It is difficult for manual analysis to analyze such a large amount of newly added malicious codes in a timely manner, so machine learning technology has been widely applied to malicious code analysis and detection systems. However, network security threats are constantly mutating and evolving rapidly. While the number is increasing, more than 70% of new malicious code samples adopt self-protection techniques to evade machine learning, and some samples even use multiple evasion techniques. Therefore, the data distribution and significance level of malicious codes are constantly changing over time, which leads to serious rapid degradation problems in machine learning-based detection models. This requires that the malicious code analysis model needs to be dynamically adjusted according to changes in network security threats, quickly absorb new knowledge, and...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to solve the existing problem of variation of malicious codes, and the problem that the prediction results of various machine

Images