Malicious code family classification method based on feature expression enhancement

Abstract

The invention relates to a malicious code family classification method based on feature expression enhancement, and belongs to a malicious code classification technology. The method comprises the following steps: firstly, decompiling a malicious code source program to obtain a. Bytes file and a. Asm file, then extracting text features of the. Asm file through an N-Gram algorithm, converting the two types of files into a gray image, extracting texture features and color features through a gray co-occurrence matrix and a gray histogram, and finally, fusing three types of single features including the text feature, the texture feature and the color feature to construct a new fusion feature. Therefore, according to the malicious code family classification method provided by the invention, the malicious code feature expression capability can be enhanced, and the malicious code family classification precision can be improved, so that malicious code attack behaviors can be effectively dealt with, and the network security of the Internet can be maintained.

Description

technical field [0001] The invention relates to a malicious code classification technology, in particular to a method for classifying malicious code families based on feature expression enhancement. Background technique [0002] With the in-depth development and large-scale application of new technologies such as cloud computing, big data, and artificial intelligence, network security threats and risks are increasing, posing huge challenges to social development. According to the "Summary of my country's Internet Security Situation in 2019", the number of computer malicious program samples captured in 2019 alone exceeded 62 million, with an average daily spread of more than 8.24 million times, involving as many as 660,000 computer malicious program families The remaining ones show that the number of malicious codes is gradually increasing, and the destructive power is constantly increasing. According to the latest security research report released by Symantec: In one day on ...

AI Technical Summary

Problems solved by technology

Because the efficiency of dynamic methods is usually too low, the current mainstream technology is still dominated by static methods

[0004] However, the extracted static features such as text and opcode cannot meet the real-time and accuracy requirements of family classification

In addition, traditional malicious code detection technology relies too much on a single feature, resulting in insufficient expression of feature information and low detection accuracy

Images