A malicious code classification method based on deep forest

Abstract

The invention discloses a malicious code classification method based on depth forest, belonging to the technical field of network security. The method comprises the following steps: performing data preprocessing, mapping malicious code binary file to image, zooming and standardizing the image; Extracting HOG eigenvector set of the image; The HOG eigenvector set is transformed into matrix, which isdivided into training set and test set. Constructing random forest; Constructing completely random forest; constructing Deep forest.wherein Deep forest is composed of multi-granularity scanning and cascade forests. Each layer is composed of equal number of random forests and completely random forests. Classifying The images with depth forests. The present application makes full use of the spatialsimilarity of malicious code images. The accuracy of classification and the accuracy of macro F1 measurement of the malicious code classification method based on the depth forest of the present application are high, and the problem of binary file reallocation is solved by scanning HOG feature matrices with windows of different sizes of the depth forest of the present application.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to a method for classifying malicious codes. Background technique [0002] With the vigorous development of the Internet, malicious code has become one of the main factors threatening Internet security. Malicious code images belonging to the same family have visual similarity after mapping malicious codes to images, and there are certain differences between malicious code images of different families. According to this characteristic of malicious code images, the features of malicious code images can be extracted and Malicious code is classified using a classification algorithm. For example, Nataraj L et al. mapped malicious code binary files to images, extracted the global features of the image by using the multi-scale and multi-directional characteristics of Gabor filter, and then used the nearest neighbor algorithm to classify malicious codes. Kancherla K et al. combin...

AI Technical Summary

Problems solved by technology

[0003] The technical problem mainly solved by the present invention is to provide a malicious code classification method based on deep forest with high classification accuracy, and solve the problem of redistribution of malicious code binary files

Images