Malicious code homology analysis method, device and apparatus

Abstract

The invention relates to a malicious code homology analysis method, which comprises the following steps of: grouping malicious code samples in a malicious code sample set, and extracting dynamic feature information and static feature information of each malicious code sample in each group; performing numerical processing on the dynamic feature information and the static feature information of the malicious code samples in each group to obtain feature vectors of the malicious code samples in each group; performing convolution operation on the feature vectors of the malicious code samples in each group by adopting a convolutional neural network to obtain feature similarity vectors among the malicious code samples in each group; and analyzing and detecting the feature similarity vector based on a dynamic BP neural network to obtain a homology detection result between malicious code samples in each group. The convolutional neural network and the dynamic BP neural network are combined, so that the analysis result can be effectively improved when the homology of the malicious codes is analyzed, and the homologous relationship detection of the malicious codes is more accurate.

Description

technical field [0001] The present application relates to the technical field of information security, and in particular to a malicious code homology analysis method, device and equipment. Background technique [0002] With the deep application of computer networks and the continuous development of malicious code technology, malicious code has become an important factor that threatens the security of computer systems. In order to adapt to different attack target environments or achieve different attack purposes, the writers of malicious code will obtain different malicious codes through modification on the basis of an original malicious code sample. In this case, these newly generated malicious codes no longer use the deformation and polymorphic techniques in traditional malicious code survival techniques. In the new situation where eat malicious code attacks are more and more organized and purposeful, defining the concept of malicious code homology, analyzing and summarizi...

AI Technical Summary

Problems solved by technology

[0003] In the face of a large number of new malicious codes, traditional malicious code analysis methods based on signatures and signatures can no longer meet the detection requirements of malicious codes. Heuristic methods, cloud detection technology and active defense technology have been proposed and have been applied to malicious code correlation analysis. and homology analysis

Images