Malicious code family clustering method and system

Abstract

The invention discloses a malicious code family clustering method and system, and the method comprises the steps: carrying out the dimension reduction visualization of an original malicious code execution sequence through employing a T-SNE algorithm, which specifically comprises the steps: carrying out the modeling of the neighbor distribution of each data point through employing the T-SNE algorithm, wherein neighbors refer to set of data points which are close to each other; constructing a model, and mapping data points to corresponding probability distribution through nonlinear function transformation; training the constructed model, and calculating the gradient of a loss function by calculating the conditional probability of a low-dimensional space; adopting a K-means algorithm to cluster malicious code families, which specifically comprises the steps that the classification number K and a clustering center are determined, cluster division is performed on all the objects by calculating the distances between the objects and the clustering center, and a new clustering center is recalculated, and whether conditions are met or not is judged. The system comprises a dimension reduction visualization module and a clustering module. According to the method, the problem of how to determine k in the K-means algorithm is solved, and the accuracy of malicious code family clustering is improved.

Description

technical field [0001] The invention belongs to the technical field of malicious code analysis, and relates to a malicious code family clustering method and system. Background technique [0002] The K-means algorithm is one of the classic clustering algorithms. When using the K-means algorithm for clustering, it is necessary to pre-set the number of clusters, namely k. However, in practical applications, the data set is often large in scale, and it is difficult for people to determine the number of clusters in advance in the face of data with complex structure distribution. When the gap between the preset number of clusters and the actual number of clusters is too large, The clustering effect will be greatly reduced: when k is selected to be much smaller than the actual number of clusters, the data points of different classes will be clustered into the same class, resulting in a low distinction between clusters; when k is selected to be much larger than the actual number of ...

AI Technical Summary

Problems solved by technology

However, due to the lack of an overall grasp of the data structure distribution, in the face of a huge amount of data, the possible value range of k is generally large during the test process, which leads to a large amount of test calculations and consumes a lot of computing resources

Images