A method, system and storage medium for identifying malware mining

Abstract

The invention discloses a mining malicious software identification method, system and storage medium. The method includes the following steps: data preprocessing of different dimensions; text feature extraction and vectorization; building a multi-model integrated mining malicious software based on Stacking The software recognizes the model; obtains the prediction result. The present invention is currently one of the few methods for detecting mining malware for binary files, which has strong pertinence, simple implementation process, and high efficiency; and the present invention extracts multi-dimensional features of mining software features from multiple angles, A multi-model integration method is designed for features of different dimensions, and a combination model for mining malware identification is constructed. This model has high recognition accuracy and low false positive rate.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a mining malicious software identification method, system and storage medium. Background technique [0002] In recent years, as the economic value of cryptocurrencies continues to rise, more and more cybercriminals use malware to occupy the victim's system and network resources for mining without the user's knowledge or permission, thereby Get cryptocurrencies for profit. Mining malware is generally highly concealed and difficult to detect. Once the computer is compromised, the malware will run silently in the background. Because the mining program consumes a lot of CPU or GPU resources, and takes up a lot of system resources and network resources, it will cause the system to run stuck or the status is abnormal, which will cause the performance of the victim's computer to decline, and the degree of performance decline will increase with the Mining malware i...

AI Technical Summary

Problems solved by technology

Among them, the static method of mining malicious sample detection based on binary files does not need to actually execute the malware, so the speed is relatively fast and will not cause malicious behaviors that endanger the operating system, but it is difficult for malware polymorphism, deformation and packing methods. Difficult to extract effective features

The signature-based detection method and the heuristic-based detection method in the static method are simple and effective, but rely on the signature library and security personnel's analysis of mining malware respectively, which will be limited with the increase of mining malicious samples, resulting in Low detection efficiency

The dynamic analysis method for mining malicious sample detection based on binary files needs to actually run the malware, and the dynamic method cannot be used to detect mining malicious samples that cannot run

In addition, simulating all malware behavior requires constant monitoring of malware behavior, resulting in a huge waste of computer resources, so dynamic analysis methods are not very applicable when detecting a large number of mining malware

Images