Malicious software family classifier generation method and device based on weak coupling SGAN and readable storage medium

Abstract

The invention provides a malicious software family classifier generation method and device based on weak coupling SGAN, and a readable storage medium, which are used for adapting to family classification model training of malicious software with a part of family-label-free malicious software, and finally determining that to-be-detected software belongs to a certain type of malicious software family. According to the method, a function of extracting original graphic features of malicious software is realized through a binary file of the malicious software in combination with an improved malicious software image scaling algorithm, an original malicious software family classifier is trained by utilizing 1D-CNN of a VGG model and the malicious software with family tags, then a weakly coupled semi-supervised generative adversarial network model is adopted, a malware family classifier, a research and judgment device in a semi-supervised generative adversarial network and a generator are trained by utilizing unlabeled malware, and finally the malware family classifier with a wider application range is obtained. The method has a good effect on classification of malicious software with unknown family tags or inaccurate family tags.

Description

technical field [0001] The present invention relates to the field of cyberspace security, malware and deep learning, and in particular to a weakly coupled SGAN-based malware family classifier generation method, device and readable storage medium. Background technique [0002] Malware family classification is the basis for analyzing and understanding malware attack targets, and it is also an important part of attack discovery. At the same time, with the continuous innovation and development of artificial intelligence technology, it is a trend to apply deep learning technology to malware family classification. In the early malware detection, there was a technical invention that used the Restricted Boltzmann Machine (RBM) to pre-train the multi-layer perceptron, which improved the detection accuracy of Android malware; With the Recurrent Neural Network (RNN), and file headers (Headers), tags (Tags), instruction opcodes (Opcodes), and API call sequences as features, the detecti...

AI Technical Summary

Problems solved by technology

This kind of feature extraction technology, especially dynamic behavior features, will cause relatively large delay and cost, and the goal of using deep learning technology is to quickly classify malware families through the classifier generated by training, However, it is less effective at classifying malware with unknown or inaccurate family labels

Images