Malicious code detection method based on API fragments

Abstract

The invention discloses a malicious code detection method based on API fragments, Intrinsic attributes of malicious codes are local maliciousness; on the basis, local features capable of keeping malicious code attributes are extracted, an LSTM model is constructed through deep learning, a set of classifiers are trained, and then decision judgment is made on the whole code sequence through an ensemble learning method. On the basis of API fragment detection, an integrated framework is realized and is used for malicious code detection, a malicious code camouflage technology can be effectively resisted, and a remarkable effect is achieved for improving the application of a machine learning method.

Description

technical field [0001] The invention is mainly used in the field of malicious code detection, and specifically relates to API execution sequences, and trains a classifier through API fragments, and comprehensively judges malicious attributes of codes on the basis of identifying API fragments. Background technique [0002] In the field of malicious code detection, it is mainly divided into traditional feature analysis and current machine learning methods. Traditional feature analysis is highly accurate, but it consumes a lot of human resources and relies on a lot of professional knowledge. Machine learning methods can learn some difficult-to-extract features with high efficiency, but they are extremely susceptible to interference, such as software countermeasures such as confusion, polymorphism, and encryption, which greatly restricts online application of machine learning methods and greatly reduces performance. quick. [0003] At present, a large number of malicious codes...

AI Technical Summary

Problems solved by technology

At the same time, there are a large number of unknown malicious codes

The feature-based detection technology of the traditional method is difficult to deal with malicious code variants, etc. The machine learning method is affected by the training set and has limited ability to detect unknown malicious code.

Images