Method, system and storage medium for apt organization identification based on stacking integration

Abstract

The invention discloses an APT organization identification method, system and storage medium based on stacking integration. The method includes: using TF-IDF algorithm combined with n-gram to extract behavioral features from malware samples and vectorize them to form malicious behavior vector features set; based on the malicious behavior vector feature set, calculate the correlation between features and the chi-square value between features and categories, and perform two screenings on the behavior vector feature set to obtain better feature subset data in low latitude; construct a multi- The Stacking ensemble of model fusion learns the APT organization identification model, and uses the APT organization identification model to identify new APT attacks. In the present invention, the feature selection of high-dimensional behavior vector features reduces the complexity of the data set; the sample imbalance in the data set is also considered, and multi-model integrated training is adopted to improve the recognition accuracy; in addition, this patent is for malicious samples. The APT organization identification model is obtained through machine learning training, which improves the automatic identification efficiency of new samples.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an APT organization identification method, system and storage medium based on stacking integration. Background technique [0002] APT advanced persistent threat is an attack form that uses advanced attack methods to carry out long-term and persistent network attacks on specific targets. Different from traditional network attacks, APT attacks have the characteristics of concealment, pertinence, persistence, and organization. Its attack methods are varied, the attack effect is significant, and it is difficult to prevent. The cyber attacks carried out by APT organizations usually have political or economic purposes, have a huge impact on countries and enterprises, and pose increasingly serious threats to various high-level information security systems. Organizational differentiation of malware samples that implement APT attacks is conducive to tracing the real ...

AI Technical Summary

Problems solved by technology

[0005] The above analysis techniques in the industry are mainly based on the manual analysis of relevant security experts, and are greatly influenced by the experience of experts. Secondly, they cannot meet the needs of a large number of samples, and are inefficient and time-consuming.

The static API function features that the automatic identification technology in academia relies on will make feature extraction difficult due to malware obfuscation and packing techniques. In addition, the current methods mainly rely on known malicious code samples. If only based on existing samples to identify Variants, which may lead to inefficient or even ineffective recognition

Images