Malicious software operation code analysis method based on convolutional neural network

Abstract

The invention discloses a malicious software operation code analysis method based on a convolutional neural network. The method comprises the steps of: obtaining a Dalvik byte code; obtaining an operation code sequence, and representing the operation code sequence by a one-hot vector; converting the one-hot vector into a vector with a fixed size, multiplying the vector by a random weight matrix, and inputting the vector into a convolutional neural network; outputting a feature mapping set matrix C in the convolution layer; in k-max pooling, performing maximum merging operation on the matrix C,and extracting the most important k characteristic values to output a characteristic vector Z; forming a full connection layer by the vector Z, and operating the vector Z in the full connection layerto obtain an output feature y; processing the output feature y by using a softmax function to obtain relative probability distribution p; calculating a cross entropy loss function Lk; gradually adjusting the minimum loss function and the parameter values of the corresponding model by using a gradient descent method; iteratively updating model parameters based on the output calculations and optimizing the detection model. The method has the characteristic of high detection accuracy.

Description

technical field [0001] The invention relates to the field of malware detection, in particular to a method for analyzing malware operation codes based on a convolutional neural network. Background technique [0002] The current analysis of Android malware mainly includes static analysis of Hindroid, which is a method of linking applications based on meta-paths, and dynamically identifies Android systems. In terms of deep learning, there is a detection method based on convolutional neural networks. , and the detection method of McLaughlin N. These methods have shortcomings such as insufficient accuracy, low classification success rate, low efficiency, and incomplete extraction of opcode sequences. Contents of the invention [0003] In order to solve the problems in the prior art, the present invention provides a malware operation code analysis method based on a convolutional neural network, which has the characteristics of high detection accuracy. [0004] In order to solv...

AI Technical Summary

Problems solved by technology

These methods have shortcomings such as insufficient accuracy, low classification success rate, low efficiency, and incomplete extraction of opcode sequences.

Images