Malicious software identification method and system based on multi-model features and related device

Abstract

The invention discloses a malicious software identification method based on multi-model features, and the method comprises the steps: carrying out the feature extraction of each feature extraction model in a preset feature extraction model set for each PE file in to-be-detected software, and obtaining each original feature; performing fusion processing on each original feature to obtain a fusion feature vector; and classifying the fused feature vectors by using a linear classifier to obtain a malicious software identification result. Meanwhile, multiple feature extraction models in the featureextraction model set are used for realizing feature extraction of the same to-be-detected file. Original features extracted by all the models are fused to obtain a fused feature vector, finally, a linear classifier is used for completing malicious software recognition on the fused feature vector, the advantages of multiple feature extraction models can be achieved at the same time, and the malicious software recognition accuracy is improved. The invention further discloses a malicious software identification system and device based on the multi-model features and a computer readable storage medium, and the system and device have the above beneficial effects.

Description

technical field [0001] The present application relates to the field of malware identification, in particular to a method, system, device and computer-readable storage medium for malware identification based on multi-model features. Background technique [0002] With the continuous development of computer programming technology, software based on various computer language programming also enables people to complete various tasks and work on the computer more conveniently, but malicious software with malicious content also appears, and malicious attacks Normal data files or theft of other people's labor results. Therefore, it is very important to identify whether the software under test is malicious software. [0003] Regardless of how to identify malicious content, it is always necessary to extract the corresponding identification feature information from the software under test, while traditional malware identification methods often rely on a specific feature extraction alg...

AI Technical Summary

Problems solved by technology

When the actual situation is not the case, due to the increasingly diverse manifestations of malicious content and malware, it is increasingly unfeasible to use only a fixed feature extraction algorithm or model, because it is impossible to analyze new types of Malicious content is better identified, resulting in worse and worse actual use effects

Images