Malicious software detector concept drift resisting method based on generative adversarial network

Abstract

The invention belongs to the technical field of network security, and discloses a malicious software detector concept drift resistance method based on a generative adversarial network, which comprisesthe following steps: extracting an API (Application Program Interface) call sequence of malicious codes from a sandbox, and converting the API call sequence into a feature vector through word2vec; training an auxiliary classification generative adversarial network based on the feature vector; using the trained auxiliary classification generative adversarial network to generate a malicious code API call sequence, adding an actual malicious code API call sequence, and training through a GRU network to obtain a malicious software detector; and taking a detection result of the malicious softwaredetector as a training set, retraining the auxiliary classification generative adversarial network, and retraining the malicious software detector to improve the concept drift resistance of the malicious software detector. The aging of the detector can be effectively resisted.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an anti-concept drift method for a malware detector based on a generative confrontation network. Background technique [0002] The network environment is becoming more and more complex, and various attack methods emerge in an endless stream. As an important carrier of network attacks, malware has various functions such as destruction, theft, and extortion. According to the Kaspersky Annual Report 2019 (https: / / securelist.com / ksb-2019 / "Kaspersky Security Bulletin 2019"), the number of new malware detected in 2019 reached approximately 24 million Security poses a serious threat. Therefore, it is of great significance to be able to effectively detect malware. [0003] The conventional means of defending against malware at this stage is usually the use of commercial anti-virus software. Commercial antivirus software uses signature-based methods or heuristic-ba...

AI Technical Summary

Problems solved by technology

[0005] The present invention aims at the existing anti-sample drift method that does not consider the impact of time deviation, so that the problem of concept drift caused by malicious samples changing with time cannot be better solved, and proposes a malware detection based on generative adversarial networks Anti-concept Drift Method

Images