Malware opcode analysis method based on convolutional neural network

Abstract

The invention discloses a malware operation code analysis method based on a convolutional neural network, comprising: obtaining a Dalvik bytecode; obtaining an operation code sequence and representing it with a one-hot vector; converting the one-hot vector into a vector with a fixed size, Then multiply the random weight matrix and input it to the convolutional neural network; output the feature map set matrix C in the convolutional layer; in k-max pooling, perform the maximum merging operation on the matrix C to extract the most important k eigenvalues The output feature vector Z; the vector Z forms a fully connected layer, and the vector Z is operated in the fully connected layer to obtain the output feature y; the softmax function is used to process the output feature y, and the relative probability distribution p is obtained; the cross entropy loss function Lk is calculated; the gradient is used The descent method gradually adjusts the parameter values ​​of the minimized loss function and the corresponding model; iteratively updates the model parameters and optimizes the detection model based on the output calculation. The invention has the characteristics of high detection accuracy.

Description

technical field [0001] The invention relates to the field of malware detection, in particular to a method for analyzing malware operation codes based on a convolutional neural network. Background technique [0002] The current analysis of Android malware mainly includes static analysis of Hindroid, which is a method of linking applications based on meta-paths, and dynamically identifies Android systems. In terms of deep learning, there is a detection method based on convolutional neural networks. , and the detection method of McLaughlin N. These methods have shortcomings such as insufficient accuracy, low classification success rate, low efficiency, and incomplete extraction of opcode sequences. Contents of the invention [0003] In order to solve the problems in the prior art, the present invention provides a malware operation code analysis method based on a convolutional neural network, which has the characteristics of high detection accuracy. [0004] In order to solv...

AI Technical Summary

Problems solved by technology

These methods have shortcomings such as insufficient accuracy, low classification success rate, low efficiency, and incomplete extraction of opcode sequences.

Images