Remote access Trojan intelligent analysis method based on meta-learning

Abstract

The invention discloses a remote access Trojan intelligent analysis method based on meta-learning. The method comprises the following steps: acquiring an application data set; defining a meta-task; performing meta-task training to obtain a behavior sample; performing statistics according to the behavior samples corresponding to the malicious program samples and the legal program samples to obtain behavior vectors of the behavior samples; training the GMMs model by using the behavior vector of each behavior sample, and training to determine a final K value and a clustering center and size; and detecting an online program to be analyzed by utilizing the trained GMMs model. According to the method, an intelligent RAT rogue program analysis and detection model based on a meta-learning algorithm and utilizing a Gaussian mixture model, Euclidean distance and dynamic behavior characteristics is constructed, the process of learning and judging rogue programs by security experts is simulated, program behavior vectors are constructed by utilizing the dynamic behavior characteristics, and efficient and accurate detection for RAT is realized.

Description

technical field [0001] The application belongs to the technical field of information security, and specifically relates to an intelligent analysis method for remote access Trojans based on meta-learning. Background technique [0002] At present, the network security situation has entered a new era. Facing various new battlefields and markets, new architectures and new methods are needed to support and cope with more and more difficult tasks. To vigorously develop information system security testing and verification technologies, In particular, it is imminent to develop intelligent detection and analysis technology for advanced network attacks, realize the security and controllability of information systems, and seek a leading position in cyberspace confrontation. [0003] Current malicious file and malicious program detection methods cannot adapt to the complex and changeable characteristics of advanced network attacks. Mainly manifested in: On the one hand, the samples of ...

AI Technical Summary

Problems solved by technology

[0004] On the terminal host side, Remote Access Trojan (RAT) attack tools are difficult to collect and have limited ability to express malicious behavior

Most of them are in the hands of hackers and attack organizations. In addition, the RAT samples collected by security companies such as Symantec are mostly controlled terminals, which cannot actively trigger dynamic behaviors, and thus cannot generate sufficient dynamic execution training data.

Images