Large-scale malicious software classification system and method based on deep learning

Abstract

The invention discloses a large-scale malicious software classification system and method based on deep learning, and relates to the technical field of computer information security. The large-scale malicious software classification system comprises a database module, a disassembling module, a malicious software embedding module and a deep learning module, and the database module is configured toperiodically and automatically collect malicious software information from a network space, especially each large open-source malicious software platform; the disassembling module performs disassembling analysis on the malicious software; the malicious software embedding module comprises a malicious software embedding method, maps a malicious software disassembling file to a vector space and outputs a malicious software vector; the deep learning module is used for learning on the supervised malicious software sample set to obtain a mature model in a training stage; in the detection stage, vectors of the malicious software are input into the mature model, family information of the malicious software is output, a classification result is obtained. Through implementation of the scheme, the classification efficiency and robustness of the large-scale malicious software are improved.

Description

technical field [0001] The invention relates to the technical field of computer information security, in particular to a large-scale malware classification system and method based on deep learning. Background technique [0002] Malware classification is the problem of computing a family label from a knowledge base given a class of malware samples. In recent years, with the introduction of polymorphic and metamorphic technologies, the quality and quantity of malware have exploded, and the task of malicious detection of large-scale data samples has become the main task of current anti-virus products. One of the challenges. [0003] Malware Classification Method Based on Traditional Feature Extraction [0004] Traditional malware classification methods mainly follow the technical route of manually extracting and fusing sample features and then selecting machine learning classification algorithms for classification. According to the form of feature extraction, it can be divid...

AI Technical Summary

Problems solved by technology

[0012] In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is to design a robust malware vectorization method and construct an efficient deep neural network to solve the problem of high labor cost, low efficiency, and robustness in malware classification. not strong problem

Images