Method and system for detecting malicious code

Abstract

The present invention relates to a method and a system for detecting malicious codes. The method includes: A. extracting corresponding features from the binary data of a single PE file in a training data set; B. reducing the dimensionality of the features; C. extracting through a gated convolutional network The feature of the binary data is the first half of the deep learning model; D. After combining the feature after dimension reduction with the feature vector obtained in step C, input it into the fully connected neural network as the second half of the deep learning model to generate the final classification Feature vector; E. All PE files have generated corresponding feature vectors to be classified; F. After classifying all feature vectors to be classified, compare them with the known categories in the test data set to verify the correctness of the deep learning model, and pass Adjust the parameters to obtain the optimal deep learning model. The invention can accurately detect whether unknown software contains malicious code without being affected by the conversion of malicious code instructions, and also improves the detection efficiency.

Description

technical field [0001] The invention relates to a method and a system for software safety detection, in particular to a method and a system for detecting malicious codes. Background technique [0002] In the anti-virus research and the confrontation process of malicious code, the continuous development of malicious code technology has also promoted the continuous development and progress of malicious program detection technology, and the new malicious code writing technology has also led to the emergence of new detection technology. [0003] Deep learning has achieved good results in both computer vision and speech recognition. In terms of computer vision, Krizhevsky et al. proposed the use of deep convolutional neural networks for image classification, Farabet proposed a method for hierarchically learning scene labels, and Kavukcuoglu proposed a convolution recognition method for visual functions. [0004] N-gram is a concept in the field of natural language processing, an...

AI Technical Summary

Problems solved by technology

[0006] The invention provides a method and system for detecting malicious codes, which can accurately detect whether the software contains malicious codes without being affected by the transformation of malicious code instructions, so as to solve the problem of being unable to accurately identify whether an unknown software is malicious in the prior art software problem

Images