Malicious code family clustering method and device and computer equipment

Abstract

The invention provides a malicious code family clustering method. The method comprises the steps of performing family clustering on a plurality of malicious codes to obtain a first clustering result;for each ethnic class in the first clustering result, allocating the same label to the malicious code in the ethnic class, wherein the labels of the malicious codes in different ethnic classes are different; training a family clustering neural network by taking the malicious code as a sample, wherein the number of neurons of an output layer of the family clustering neural network is equal to the number of classes contained in the sample; performing feature extraction on each malicious code by using the trained family clustering neural network to obtain features of each malicious code; clustering the malicious codes based on the characteristics of the malicious codes to obtain a second clustering result; judging whether the difference between the second clustering result and the last clustering result meets a convergence condition or not; and if so, determining the second clustering result as a family clustering result of the plurality of malicious codes. Therefore, malicious codes fromthe same family can be accurately identified.

Description

technical field [0001] The present application relates to the field of computers, in particular to a malicious code family clustering method, device and computer equipment. Background technique [0002] Malicious code refers to programs, codes or instructions specially designed for malicious purposes, and refers to all malicious software designed to destroy the reliability, availability, security or consume system resources of computers, mobile terminals or network systems. According to behavioral characteristics such as transmission mode, it is divided into types such as Trojan horse, computer virus, worm, ransomware, spyware or adware. [0003] In recent years, with the rapid development of the Internet, malicious code has become one of the main factors threatening Internet security. The study found that although the number of malicious codes has grown rapidly, the number of malicious code families (a malicious code family refers to the source of malicious codes, in which...

AI Technical Summary

Problems solved by technology

However, when the traditional method is used to extract the features of malicious code, the extracted features are not comprehensive and accurate enough, so that the family information determined based on the feature analysis is also inaccurate

Images