Malware classification method for optimizing feature extraction

Abstract

The invention belongs to the field of information security, and particularly relates to a malicious software classification method for optimizing feature extraction. According to the method, the extraction mode of malicious software is optimized, and the convolutional neural network in deep learning is used as a main classifier. The single static feature cannot reflect the feature of the malware comprehensively, for example, the grayscale image can only represent the overall contour of the malware, and the API call image can only represent the control structure of the malware. Aiming at the problems, the method extracts the two features, and combines the two features into a dual-channel picture feature matrix to serve as the input of the convolutional neural network, so that the overall contour of the malicious software can be expressed, and the process which can be executed by the malicious software can be completely expressed. According to the method, the problem that malicious software cannot be completely embodied during sample feature extraction is effectively solved, and a good classification effect is achieved.

Description

technical field [0001] The invention belongs to the field of information security, and in particular relates to a malicious software classification method for optimizing feature extraction. Background technique [0002] Malware refers to various forms of malicious or intrusive software, such as computer viruses, worms, spyware, Trojan horses, adware, etc. These malware usually exist in the form of executable programs, scripts, etc. In the field of computer system security, an important issue is to detect and identify malicious software, so as to remove the malicious software before it runs, so as to avoid damage to the computer system or losses to users. Not only black hat hackers or other malicious software authors, but even software from reputable vendors can contain malicious code. For example, Sony once implanted Rootkits in the records it sold. This is a Trojan horse that is silently installed and hidden on the buyer's computer in order to prevent the illegal copying...

AI Technical Summary

Problems solved by technology

[0004] However, traditional malware detection methods usually use digital signature technology, which has certain limitations in dealing with the surge in the number of malware

Images