A malicious code classification method based on image texture fingerprint

Abstract

The invention discloses a malicious code classification method based on image texture fingerprint. By combining image analysis technology with malicious code classification technology, the operation code is mapped into two-channel uncompressed gray image after being numeralized, Then according to the method of gray-scale transformation, the dual-channel image is transformed into a single-channel gray-scale image, and the texture features of the image are extracted by gray-scale co-occurrence matrix, and these features are regarded as the essential features of malicious code. Finally, the malicious code is classified by random forest algorithm. The malicious code classification method based on image texture fingerprint of the invention reduces the number of features used for expressing themalicious code and improves the classification speed of the malicious code. On the other hand, it effectively overcomes the malicious code confusion problems such as opcode rearrangement and code transformation, and improves the accuracy of malicious code classification.

Description

technical field [0001] The invention relates to the field of malicious code classification, in particular to a malicious code classification method based on image analysis. Background technique [0002] With the vigorous development of the Internet, malicious code has become one of the main factors threatening Internet security, and it shows a trend of rapid growth. In the prior art, methods for analyzing and identifying malicious code usually include static analysis methods and dynamic analysis methods. The dynamic analysis method is to analyze the code during the running process, and the analyzed code is the code actually executed. However, many malicious codes have multiple execution paths, so the dynamic analysis method itself has certain limitations; the static analysis method first disassembles the executable program, and extracts the code on this basis. Classify the characteristic information, in the prior art, many researchers have converted the malicious code into ...

AI Technical Summary

Problems solved by technology

[0003] The present invention provides a malicious code classification method based on image texture fingerprints, which solves the problem that the malicious code classification technology in the prior art cannot effectively identify confusing malicious codes, and the amount of extracted feature data is large, which in turn leads to low accuracy of malicious code classification, slow speed problem

Images