A method, device and storage medium for detecting malicious programs

Abstract

The present invention provides a method, device and storage medium for detecting malicious programs. In the method, a sample file to be detected is statically analyzed, and if it cannot be determined whether the sample file is malicious, dynamic analysis and identification is performed on the sample file. Determine whether the sample file is malicious, then use the deep learning detection model to detect, and use the behavior of dynamic analysis and the static information of static analysis to convert the image suitable for deep learning model recognition into classification when the deep learning model is detected. Three-level detection improves the detection rate of malicious programs, greatly improves the recognition rate of widely spread deformed malicious programs and polymorphic malicious programs, and reduces the false positive rate, and also improves the detection speed and improves user experience. .

Description

technical field [0001] The invention relates to the technical field of database processing, in particular to a method, device and storage medium for detecting malicious programs. Background technique [0002] Traditional malicious program detection technologies include signature detection, behavior detection, heuristic scanning, and machine learning. The principles of these detections are different, the overhead required for implementation and the scope of detection are different, and they all have some limitations, which cannot deal with malicious programs under new technologies. It is commonly used to detect malicious programs based on statistical and feature rule analysis and using virtual technology. However, compared with the development speed and trend of malicious programs, as well as the number of malicious programs, traditional malicious program detection technology has entered a technical bottleneck and cannot meet the detection requirements of malicious programs....

AI Technical Summary

Problems solved by technology

With the exponential growth of malicious programs, traditional detection methods are no longer sufficient to ensure the security of the operating environment

Images