Malicious file detection technology based on random forest algorithm

Abstract

The invention discloses a malicious file detection technology based on a random forest algorithm. In order to overcome the defect or deficiency of detecting malicious files by using a feature matchingmethod in the prior art, a scheme of extracting effective features and detecting the malicious files by using a machine learning algorithm is adopted, so that the purpose of accurately and effectively identifying known and unknown malicious files is achieved.

Description

technical field [0001] The invention relates to the technical field of data processing, in particular to a malicious file detection technology based on a random forest algorithm. Background technique [0002] Since the popularization and development of the Internet, computer malicious programs that destroy the system, tamper with files, affect system stability and execution efficiency, and steal information have always been important problems in computer use. These malicious programs include Trojan horse programs, ransomware, spy programs, etc., which may cause great harm or great property loss to enterprises or users. Therefore, using effective means to accurately identify malicious files has become a key point of computer security defense. [0003] The current detection methods mainly adopt signature-based detection and killing and heuristic artificial characteristic behavior detection and killing. Among them, the detection and killing based on the signature code is base...

AI Technical Summary

Problems solved by technology

Among them, the detection and killing based on the signature code is based on the detection of antivirus software technology. This method cannot effectively identify unknown malicious programs. Only when the signature code of the malicious program is added to the virus database can it be detected.

The heuristic artificial characteristic behavior detection and killing is to describe and analyze the behavior characteristics of a large number of viruses, and use the classic virus behavior characteristic string as the detection standard.

[0004] The above rule-based detection scheme can only detect known malicious file types, but cannot better identify increasingly newer malicious file types

Images