A Malicious Code Classification Method Based on Image Texture Fingerprinting

Abstract

The invention discloses a malicious code classification method based on image texture fingerprints. By combining image analysis technology and malicious code classification technology, the operation code is digitized and mapped to a two-channel uncompressed grayscale image, and then according to the grayscale transformation method The dual-channel image is converted into a single-channel grayscale image, the texture features of the image are extracted using the gray level co-occurrence matrix, and these features are used as the essential features of the malicious code. Finally, the random forest algorithm is used to classify the malicious code. The malicious code classification method based on image texture fingerprints of the present invention reduces the number of features used to express malicious codes on the one hand and improves the classification speed of malicious codes; on the other hand, it effectively overcomes malicious codes such as rearrangement of operation codes and code transformation The problem of code obfuscation improves the accuracy of malicious code classification.

Description

technical field [0001] The invention relates to the field of malicious code classification, in particular to a malicious code classification method based on image analysis. Background technique [0002] With the vigorous development of the Internet, malicious code has become one of the main factors threatening Internet security, and it shows a trend of rapid growth. In the prior art, methods for analyzing and identifying malicious code usually include static analysis methods and dynamic analysis methods. The dynamic analysis method is to analyze the code during the running process, and the analyzed code is the code actually executed. However, many malicious codes have multiple execution paths, so the dynamic analysis method itself has certain limitations; the static analysis method first disassembles the executable program, and extracts the code on this basis. Classify the characteristic information, in the prior art, many researchers have converted the malicious code into ...

AI Technical Summary

Problems solved by technology

[0003] The present invention provides a malicious code classification method based on image texture fingerprints, which solves the problem that the malicious code classification technology in the prior art cannot effectively identify confusing malicious codes, and the amount of extracted feature data is large, which in turn leads to low accuracy of malicious code classification, slow speed problem

Images