Collaborative learning-based visual malicious software detection method

Abstract

The invention discloses a visual malicious software detection method based on collaborative learning. The method comprises an initialization process and a collaborative training process. The initialization process specifically comprises the following steps: (1) software visualization; (2) feature extraction; the cooperative training process specifically comprises the steps: (3) performing multi-classifier new sample cooperative training marking; (4) executing a voting detection process. According to the method, a small number of marked software sample features can be used for modeling, and the detection performance of the model is continuously optimized through a large number of unmarked samples, so that the malicious software detection model has self-learning and self-adaption capabilities, the dependence on manual software sample marking is reduced, and the problem that a malicious software classification model based on machine learning is difficult to effectively train due to the fact that marked samples are difficult to collect in malicious software detection is solved.

Description

technical field [0001] The invention relates to the technical field of cyberspace security, in particular to a collaborative learning-based visual malware detection method. Background technique [0002] Malware is a serious security threat facing the current cyberspace, which has the characteristics of fast generation, wide spread and strong infection ability. Malware includes Trojan horses, viruses, worms, and malicious backdoors. Since the 1990s, researchers have begun to conduct in-depth research on malware detection. Existing malware detection methods include static detection and dynamic detection methods. Currently, widely used detection methods include signature-based detection, behavior-based detection and heuristic scanning, etc. [0003] In traditional detection methods, before analyzing the captured malware, it is necessary to manually use tools such as disassembly software, virtual machines, and sandboxes to analyze the malware, resulting in the identification o...

AI Technical Summary

Problems solved by technology

[0003] In traditional detection methods, before analyzing the captured malware, it is necessary to manually analyze the malware using tools such as disassembler software, virtual machines, and sandboxes. As a result, the identification of malware often lags behind the spread of software.

At the same time, in the actual detection scenario, it is very difficult to obtain marked malicious samples because the signatures of malicious samples need to undergo a lot of manual decoding and analysis.

However, a large number of unlabeled software samples cannot be used in the traditional malware detection model training process due to the lack of labels.

[0004] Traditional malware detection methods require a lot of manual decoding and analysis to achieve feature extraction and sample labeling of malicious samples

The cost of manually analyzing malicious samples is too high, making it difficult to obtain marked malicious samples, and a large number of unmarked malicious samples cannot be used in the detection model training process and are left idle

Images