Malicious software classification method and system based on dual-channel convolutional neural network

Abstract

The invention discloses a malicious software classification method and system based on a dual-channel convolutional neural network, and the system comprises: a training sample processing module and anoperation code extraction module which are used for decompiling a training sample, and obtaining an operation code sequence of an application program; an API feature extraction module which is used for obtaining sensitive API features of the training sample; a dual-channel convolutional neural network training module which is used for training by using the operation code sequence and the sensitive API feature sequence and obtaining a dual-channel convolutional neural network of which the output is accurate; an accuracy judgment module and a detection module which are used for judging whetherthe accuracy output by the dual-channel convolutional neural network reaches a set value or not, and detecting the to-be-identified software when the accuracy reaches the set value; and a probabilityoutput module which is used for outputting a probability value that the to-be-identified software is malicious software. According to the method, the advantages of the operation code sequence of the application program and the sensitive API feature detection are combined, and the accuracy and the data processing are greatly improved.

Description

technical field [0001] The invention relates to the field of malicious software detection, in particular to a method and system for classifying malicious software based on a dual-channel convolutional neural network. Background technique [0002] With the development of science and technology, the types and complexity of malware are getting higher and higher, and the identification of malware is becoming more and more difficult, especially in the mobile field platform. Given the rapid growth of mobile devices and mobile app stores. The number of new applications is too large to manually check each program for malicious behavior. Malware detection has traditionally been based on manual detection of known malware behaviors or codes to manually design malware signatures, a process that makes it difficult to detect a large number of applications. [0003] There are two mainstream detection methods at this stage. The first one is to obtain training samples, which are execution ...

AI Technical Summary

Problems solved by technology

At present, these two methods have the disadvantages of unsatisfactory recognition accuracy, cumbersome operation, and large amount of data.

Images