Malicious code detection method and system

Abstract

The invention relates to a malicious code detection method and system. The method comprises the steps that A, extracting corresponding features from binary data of a single PE file in a training dataset; b, performing dimension reduction processing on the features; c, extracting the features of the binary data as the front half part of the deep learning model through a gated convolutional network; d, combining the features after dimension reduction with the feature vectors obtained in the step C, inputting the combined features into a full-connection neural network serving as the rear half part of the deep learning model, and generating final feature vectors to be classified; e, generating corresponding to-be-classified feature vectors for all PE files; and F, classifying all the to-be-classified feature vectors, comparing the classified feature vectors with known categories in the test data set to verify the correctness of the deep learning model, and obtaining an optimal deep learning model by adjusting parameters. According to the method, the influence of malicious code instruction transformation can be avoided, whether the unknown software contains the malicious code or not can be accurately detected, and the detection efficiency is also improved.

Description

technical field [0001] The invention relates to a method and a system for software safety detection, in particular to a method and a system for detecting malicious codes. Background technique [0002] In the anti-virus research and the confrontation process of malicious code, the continuous development of malicious code technology has also promoted the continuous development and progress of malicious program detection technology, and the new malicious code writing technology has also led to the emergence of new detection technology. [0003] Deep learning has achieved good results in both computer vision and speech recognition. In terms of computer vision, Krizhevsky et al. proposed the use of deep convolutional neural networks for image classification, Farabet proposed a method for hierarchically learning scene labels, and Kavukcuoglu proposed a convolution recognition method for visual functions. [0004] N-gram is a concept in the field of natural language processing, an...

AI Technical Summary

Problems solved by technology

[0006] The invention provides a method and system for detecting malicious codes, which can accurately detect whether the software contains malicious codes without being affected by the transformation of malicious code instructions, so as to solve the problem of being unable to accurately identify whether an unknown software is malicious in the prior art software problem

Images