A malicious code family clustering method and system

Abstract

The present invention discloses a malicious code family clustering method and system, the method includes adopting the T-SNE algorithm to perform dimensionality reduction and visualization on the original malicious code execution sequence, specifically: using the T-SNE algorithm to carry out the distribution of the neighbors of each data point Modeling, where neighbors refer to the collection of data points close to each other; construct a model, and map the data points to the corresponding probability distribution through nonlinear function transformation; train the constructed model, and calculate the conditional probability of the low-dimensional space to calculate The gradient of the loss function; use the K-means algorithm to cluster the malicious code family, specifically: determine the classification number K and the cluster center; divide all objects into clusters by calculating the distance between the object and the cluster center; recalculate the new The cluster center of , to judge whether the conditions are satisfied. The system includes a dimensionality reduction visualization module and a clustering module. The invention not only reduces the difficult problem of how to determine k in the K-means algorithm, but also improves the accuracy of malicious code family clustering.

Description

technical field [0001] The invention belongs to the technical field of malicious code analysis, and relates to a malicious code family clustering method and system. Background technique [0002] The K-means algorithm is one of the classic clustering algorithms. When using the K-means algorithm for clustering, it is necessary to pre-set the number of clusters, namely k. However, in practical applications, the data set is often large in scale, and it is difficult for people to determine the number of clusters in advance in the face of data with complex structure distribution. When the gap between the preset number of clusters and the actual number of clusters is too large, The clustering effect will be greatly reduced: when k is selected to be much smaller than the actual number of clusters, the data points of different classes will be clustered into the same class, resulting in a low distinction between clusters; when k is selected to be much larger than the actual number of ...

AI Technical Summary

Problems solved by technology

However, due to the lack of an overall grasp of the data structure distribution, in the face of a huge amount of data, the possible value range of k is generally large during the test process, which leads to a large amount of test calculations and consumes a lot of computing resources

Images