Visual malicious software detection device and method based on deep neural network

Abstract

The invention discloses a visual malicious software detection device and method based on a deep neural network, and the method comprises the steps: converting an executable file sample into a bytes file and an asm file through employing a disassembly technology, combining a normal software data set collected and marked by a user with a famous BIG 2015 malicious software data set, and obtaining a balance experiment data set; in order to effectively extract high-dimensional features in a data sample, converting the sample further into an RGB three-channel image by using a visualization technology combined with data enhancement. The invention also provides unique deep neural network classification architecture, which is used for improving the performance of the detection method. The method disclosed by the invention is explained from other numerous neural network model methods; the superiority of the RGB three-channel image in the aspect of malicious software detection compared with a gray level image is verified through experiments, and the data enhancement technology is beneficial to visualization of malicious software detection. And a novel thought and a novel method are provided for other researchers to carry out malicious software detection experiments.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a deep neural network-based visual malware detection device and method. Background technique [0002] The rapid development of Internet technology has led to the rapid progress of the computer software industry. Various types of application software have been produced one after another and have gradually affected people's lives. Unfortunately, it contains a lot of harmful malware, which seriously compromises the privacy and security of users, and can also cause damage to computers, servers and cloud computing environments. Malicious software generally has the following characteristics: automatic operation, forced installation, difficult uninstallation, malicious collection of user information, and other malicious behaviors that infringe on the legitimate rights and interests of users. [0003] Today, illegal attacks through malicious software have posed a serious threat...

AI Technical Summary

Problems solved by technology

(1) The first is the acquisition of data sets. Since malware itself is extremely easy to spread on the Internet and cause unexpected consequences, many data set providers will perform so-called "antivirus" processing on samples to make them lose their ability to operate , such as the Microsoft Malware Classification Challenge (BIG 2015) malware dataset, the Kaggle platform converts the original executable file into the corresponding bytes file (pure bytecode file) and asm file (assembler source file), but this makes it impossible for others to easily augment the dataset

(2) Secondly, most of the current detection methods only focus on the characteristics of a certain aspect of the data sample, such as only focusing on the binary files of the software samples or the source files of the assembler program, which will greatly reduce the generalization ability of the detection method. Difficult to successfully apply to unknown samples

Images