Malicious code family classification method based on fuzzy assembly instruction sequence

Abstract

The invention relates to a malicious code family classification method based on a fuzzy assembly instruction sequence, and belongs to the technical field of computer network malicious code detection. According to the method, fuzzy assembly instruction sequence features after immediate operands and constant address operands are filtered are extracted from malicious codes of different families, and a long-short-term memory network model used for malicious code family classification is trained. Compared with an existing byte code sequence and an existing operation code sequence, the adopted fuzzy assembly instruction sequence has higher accuracy in PE malicious code family classification tasks. A fuzzy assembly instruction sequence is adopted, a written instruction mask is used for shielding part of types of operands, compared with existing bytecode sequence features, the length of an input sequence is reduced, and the method has lower time cost in LSTM model training and family detection links. Compared with the existing operation code sequence features, the invention has the advantages that the depiction capability on different malicious code families is enhanced, and a better detection result is achieved.

Description

technical field [0001] The invention relates to a method for classifying a malicious code family on a network, in particular to a method for classifying a malicious code family based on a fuzzy assembly instruction sequence, and belongs to the technical field of computer network malicious code detection. Background technique [0002] With the development of the Internet, malicious code attacks have grown exponentially, and have become one of the main threats to network security. The increasingly serious information security problem has caused personal privacy information to be used maliciously, enterprises have suffered huge economic losses, and national security has also faced serious threats. [0003] With the increasing amount of malicious codes and increasingly serious threats, malware detection and defense in computer systems has become an important network security task for users and enterprises. The development trend of malicious code is very rapid. Traditional manua...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to address the defects in the prior art. In order to solve the technical problems of inaccurate and poor robustness of the classification results of malicious code polymorphic variants when detecting traditional methods, a method based on fuzzy assembly instruction sequences is proposed. Malicious code family classification method

Images