Malicious code family homology analysis based on semi-supervised density clustering

Abstract

As most of the new malicious code belong to the known malicious code family, the information of existing samples in the virus library is utilized to assist malicious code to analyze the family homology to achieve more accurate family clustering, on the basis of accurate family clustering, the family diagram of malicious code is constructed to visualize the evolutionary relationship between the varieties of malicious code in the same family and predict the development direction of the varieties, and technical support is provided for the in-depth analysis of malicious code. Combined with the evolution characteristics of malicious code, the invention provides a malicious code homology analysis model which supports family graph construction, and the experimental results show that the model iseffective. A semi-supervised density clustering algorithm is provided, and experiments show that the algorithm can achieve accurate family clustering and provide clues for the discovery of unknown families. An algorithm based on asymmetric similarity measure is provided to construct family evolution diagrams for each malicious family and visualize the evolutionary relationships among malicious samples within the same family.

Description

technical field [0001] The invention uses a semi-supervised clustering technology to carry out family clustering on malicious codes, and uses an asymmetric similarity calculation method to construct a family evolution graph to visualize the evolution relationship among variants in the same family. By studying the current clustering algorithm and the problems encountered, combined with the information of known samples in the virus database, a semi-supervised density clustering algorithm S-DBSCAN is proposed, which belongs to the data mining technology. Background technique [0002] Static automated analysis technology is difficult to resist, obfuscate, encrypt and pack static automated analysis technologies, while dynamic automated analysis technology is less efficient. Existing frameworks mostly use virtual machines as the analysis environment, which is difficult to resist dynamic analysis environment detection and technology, and cannot be obtained. Reliable and accurate dy...

AI Technical Summary

Problems solved by technology

[0006] In order to solve the weaknesses that the existing homology analysis methods cannot accurately realize the family division of malicious codes and visualize the evolution relationship between malicious code variants of the same family, the present invention improves the DBSCAN algorithm and combines the semi-supervised clustering technology to utilize known The family information of samples is used to achieve accurate family clustering of malicious codes, and on this basis, an asymmetric similarity calculation method is proposed to construct a family evolution graph, and then a method to visualize the evolution relationship between malicious code variants within a family is provided.

Images