Malicious software classification method based on PE head visualization

Abstract

The invention belongs to the technical field of computer security, and particularly relates to a malicious software classification method based on PE head visualization. According to the malicious software classification method, the PE head of the malicious software can be visualized, and the PE head is converted into the grayscale image, so that the malicious software classification problem is converted into the image classification problem. According to the malicious software classification method, the malicious software is classified by using the grayscale image of the malicious software and the fields in the PE head, and a new method for representing the malicious software by using the selectable head fields in the PE head is provided, so that the malicious software classification method has relatively high classification precision and relatively high classification speed.

Description

technical field [0001] The invention belongs to the technical field of computer security, and in particular relates to a malicious software classification method based on PE header visualization. Background technique [0002] With the rapid development of Internet technology, people use more and more Internet applications and their dependence on various software has increased significantly, which brings great convenience to the invasion and spread of malicious software. Various automated tools emerge in an endless stream, and the derivation speed of malware on the Internet far exceeds the speed of being discovered by people. For example, in the third quarter of 2018, McAfee Labs detected 850 million malicious files every day. Although the derivation speed of malware is getting faster and faster, the vast majority of malware evolves through polymorphism and deformation of known malware. For example, a report from Symantec shows that among the 410 million malicious codes dis...

AI Technical Summary

Problems solved by technology

However, there are some problems in the detection methods based on feature engineering. For example, static detection is easily affected by obfuscation technology, and dynamic detection may not be able to cover all execution paths.

The malware visualization method using grayscale images instead of feature engineering can alleviate the shortcomings of static analysis to a certain extent, but it also brings the problem of long time-consuming extraction of image texture features.

[0004] In summary, malware attacks are still rampant despite a lot of research efforts to identify malware variants

Aiming at the time-consuming and poor practicability of the current grayscale image texture feature extraction, it is of great scientific and theoretical value and importance to study malware variant recognition technology with wide application and strong practicability to improve the security of computer systems. Practical significance

Images