An Intelligent Analysis Method of Malicious Files Based on Generative Adversarial Networks

Abstract

The invention discloses a malicious file intelligent analysis method based on a generative confrontation network, based on a basic application data set, using the idea of ​​generative confrontation network confrontation interactive training, continuously generating samples by the generative model, expanding the label sample set, and improving intrusion The detection model detection classification improves the detection accuracy of intrusion behavior, can enhance the detection ability of the model to perform multi-classification tasks, and provides an effective method for improving the generalization ability of the intrusion detection model. Moreover, the intelligent malicious code detection method based on API behavior characteristics can better detect unknown malicious codes that behave similarly to known malicious code samples, without being affected by technologies such as polymorphism, code obfuscation, encryption and packing of malicious codes, Therefore, the present application has the advantages of high detection rate and low false alarm rate.

Description

technical field [0001] The present application belongs to the field of information security, and in particular relates to an intelligent analysis method for malicious files based on generative adversarial networks. Background technique [0002] With the escalation of network offensive and defensive warfare, network attacks have gradually developed from simple means to complex three-dimensional attacks represented by advanced network attacks. At present, most of the detection of advanced network attacks in the market is still at the traditional level, which is mainly divided into the following four categories: network traffic analysis, software static feature detection, dynamic sandbox detection and hook technology. Among them, network traffic analysis uses traffic to judge suspicious behavior, while software static feature detection, dynamic sandbox detection and hook technology are often used to detect malicious files and malicious programs (such as RAT). [0003] Among th...

AI Technical Summary

Problems solved by technology

Due to the difficulty in obtaining a large number of labeled samples, limited labeled samples can only feed back limited information, and existing machine learning models seldom consider the timing characteristics of learning abnormal behaviors such as synchronization and correlation in network connections. Difficult to meet the growing requirements of high detection rate and low false alarm rate

Images