Malicious sample identification method and device, computing equipment and medium

Abstract

The invention provides a malicious sample identification method. The malicious sample identification method comprises the steps of obtaining at least one malicious sample; utilizing the at least one trained classification model to respectively process the at least one malicious sample to obtain a classification result; determining a clustering model for processing the at least one malicious samplebased on the sample number of the at least one malicious sample; processing at least one malicious sample by using the clustering model to obtain a clustering result; and determining a risk categoryto which each malicious sample belongs based on the classification result and the clustering result. The invention further provides a malicious sample identification device, computing equipment, a computer readable storage medium and a computer program product.

Description

technical field [0001] The present disclosure relates to the field of computer technology, and more specifically, to a malicious sample identification method, a malicious sample identification device, a computing device, and a computer-readable storage medium. Background technique [0002] In order to improve system security, it is usually necessary to identify whether the samples accessing the system are risky, such as identifying the malicious family or attack group to which the malicious sample belongs. However, in order to avoid security detection, the important features of malicious samples are usually hidden and difficult to find. Related technologies usually use a single identification method to identify malicious samples, resulting in low identification efficiency when identifying the malicious family or attack group to which the malicious sample belongs. , The recognition accuracy is low. Contents of the invention [0003] In view of this, the present disclosure ...

AI Technical Summary

Problems solved by technology

However, in order to avoid security detection, the important features of malicious samples are usually hidden and difficult to find. Related technologies usually use a single identification method to identify malicious samples, resulting in low identification efficiency when identifying the malicious family or attack group to which the malicious sample belongs. , low recognition accuracy

Images