Feature code extraction method and device, computer equipment and readable storage medium

Abstract

The invention provides a feature code extraction method and device, computer equipment and a readable storage medium. The feature code extraction method comprises the steps of obtaining a conversion sequence of a to-be-detected code; inputting the conversion sequence to a preset deep learning model, wherein the deep learning model comprises a convolution layer; when an output layer outputs a malicious category representing that the to-be-detected code belongs to the malicious code, obtaining a feature map of a convolutional layer, wherein the convolutional layer comprises a plurality of channels; determining a gradient value on each channel; calculating thermodynamic diagram data according to the feature map and the gradient value, wherein the thermodynamic diagram data comprise contribution scores used for representing all bytes in the original byte sequence to malicious categories; and determining a feature code of the to-be-detected code according to the contribution score. According to the invention, the efficiency and accuracy of feature code extraction can be improved.

Description

technical field [0001] The present invention relates to the technical field of security threat processing, in particular to a feature code extraction method, device, computer equipment and readable storage medium. Background technique [0002] With the rapid development of computer network technology, especially the application of the Internet has become more and more extensive, while bringing convenience to people's lives, the threat of computer malicious programs to network information security has become increasingly huge. Once these malicious programs occur, they will cause damage to the computer system, tampering with files, affecting system stability, and stealing information, and causing system paralysis and even destroying the overall hardware of the system, seriously threatening information security and causing inestimable damage. Loss. [0003] At present, most antivirus software technologies detect and kill known types of malicious programs, and the most widely u...

AI Technical Summary

Problems solved by technology

[0006] However, in the actual use of enterprises, the above method 1) analyzes the disassembly code based on manual or semi-automatic methods, which requires manual participation in the analysis, consumes a lot of manpower of the enterprise, and the efficiency of extracting signatures is extremely low, lacks automation, and cannot be widely used. It is used in enterprises, especially small enterprises; the above method 2) extracts signatures based on the comparison or matching of sequence fragments. Although it is relatively more automated, the comparison or matching between sequences often has high time complexity and reduces The speed of feature code extraction cannot effectively meet the demand for real-time update of feature codes under massive malicious codes, and it is easy to cause false positives

This situation greatly limits the use of signature technology within the enterprise, reducing the effectiveness and real-time performance of scanning and killing malicious codes

Images