Malicious software detection method based on feature sequence mining and simplification

Abstract

The invention provides a malicious software detection method based on feature sequence mining and simplification. The malicious software detection method comprises the steps of obtaining API calling sequences of multiple software samples; constructing a key API dictionary and a non-key API dictionary, and simplifying the API calling sequence; extracting an API feature sequence by utilizing a determinacy and randomization forward and backward scanning mode; screening an API feature sequence by adopting statistical frequency; obtaining a final key API feature sequence set and a linear model about the weights of the key API feature sequences; and detecting whether the tested software is malicious software or not. According to the malicious software detection method based on feature sequence mining and simplification, the API feature sequence simplification technology and the key API extension scanning technology are adopted at the same time, the malicious software detection and recognition precision is improved, the time consumed by malicious software detection and recognition is shortened, and the malicious software detection and recognition efficiency is improved.

Description

technical field [0001] The invention belongs to the technical field of malicious software detection, and in particular relates to a method for detecting malicious software based on feature sequence mining and simplification. Background technique [0002] Malware refers to various forms of malicious or intrusive software, such as computer viruses, worms, spyware, Trojan horses, adware, etc. Malware usually exists in the form of executable programs, scripts, etc. In the field of computer system security, an important issue is to detect and identify malicious software, so as to remove the malicious software before it runs, so as to avoid damage to the computer system or losses to users. [0003] Malware detection and identification, the common method is malware static detection method, that is: to identify the static features of malware, where the static features mainly include executable files and their disassembled file bytecode, assembly instructions, import Features such ...

AI Technical Summary

Problems solved by technology

However, malware used in practical applications often has confusion such as deformation or garbage code insertion, which makes static detection methods unable to effectively identify confused malware and reduces the detection and classification accuracy of malware.

Images