Malicious code sample screener and method based on Two-Head exception detection model

Abstract

The invention discloses a malicious code sample screener and method based on a Two-Head anomaly detection model. The screener comprises a feature extractor, a first classification layer, a second classification layer, a softmax function module and an uncertainty measurement module, wherein the feature extractor includes a feature extraction portion in the malicious code detection model, the firstclassification layer and the second classification layer adopt classification layer structures in a malicious code detection model, and are connected with an output end of the feature extractor in parallel, the outputs of the first classification layer and the second classification layer respectively output a first classification probability value and a second classification probability value through a softmax function module, the first classification probability value and the second classification probability value are inputted into an uncertainty measurement module, and the output of the uncertainty measurement module is a classification result label, and malicious code detection samples are screened to be input into the malicious code detection model by using the trained Two-Head anomaly detection model.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a malicious code sample filter and a method based on a Two-Head anomaly detection model. Background technique [0002] In the field of network security, malicious code detection models based on deep learning are continuously proposed. The process is first to extract the static and dynamic features of the malicious code, and then import the extracted training data into the model for training and make the model converge. , to identify malware or malicious code that may exist in the network. [0003] Malicious code refers to a code sequence that is executed in a certain environment and is used to destroy the confidentiality, integrity, and availability of computer operating systems or network systems. [0004] According to whether it is executed or not during detection, the methods of analyzing malicious code are usually static analysis and dynamic analysis. Static an...

AI Technical Summary

Problems solved by technology

However, the anomaly detection technology based on the support vector machine model has a complex structure and is difficult to implement, and the training process is long and the effect is not ideal.

Images