Malware identification device and method

Abstract

A malware identification device and method. The malicious software identification device stores a training data set, which includes a plurality of network flow data sets. Each of the network traffic data sets corresponds to one of a plurality of software categories, and the plurality of software categories includes a plurality of malicious software categories. The malware identification device tests that a malware identification model has a low identification rate for a subset of the malware categories, and determines that the overlapping degree of the plurality of network traffic data sets corresponding to the subset is high , merging the malware category corresponding to the subset to update the software category, integrating the network traffic data set corresponding to the subset to update the training data set, and using the updated training data set to train the malware identification model. The trained malware recognition model is deployed in the real world.

Description

【Technical field】 [0001] The present invention relates to a malware identification device and method; in particular, the present invention relates to a malware identification device and method capable of identifying malware types based on network communication behaviors and updating malware types gradually. 【Background technique】 [0002] An information security network communication device (eg, a firewall) that identifies malware based on network communication behavior (eg, network traffic) is a first-line device for constructing an information security defense line. Such information security Netcom devices need to analyze various malicious software's external network communication behaviors (for example: communication behaviors with remote servers, network traffic) and record them. After that, if the information security Netcom device detects that a software has abnormal network communication behavior (for example: connecting to an Internet address recorded in a blacklist,...

AI Technical Summary

Problems solved by technology

[0003] This type of information security equipment cannot obtain the system behavior of the software (for example: input / output behavior, write / read action, application program interface (Application Program Interface; API) call), so it can only use the network communication behavior of the software as the The basis for identifying software as benign or malicious

However, the characteristics of network communication behavior are similar, and the types and numbers of malicious software will continue to increase due to variants, segmentation, or repackaging. It is very important to correctly identify software as normal or malicious, and even identify the type of malicious software. difficulty

In addition, if a piece of software conducts network communication in an encrypted manner, this type of information security and network communication equipment will be unrecognizable because it cannot obtain its advanced packet characteristics

Images