Software malicious behavior identification method based on ensemble learning and dynamic analysis

Abstract

The invention relates to the field of network security and information security detection, in particular to a software malicious behavior identification method based on ensemble learning and dynamic analysis. The method comprises the following steps: dynamically analyzing software by adopting a sandbox method, randomly clicking the software by using monkey to simulate the use of a user at the same time, and then extracting system calling, network behaviors, stain tracking and character string operation as dynamic characteristics; integrating a random forest, a support vector machine, naive Bayes and k-nearest neighbor by adopting an integrated learning method based on stacking, and training feature vectors to generate a training model; and inputting the dynamic features of the malicious software to be identified into the trained classifier, and completing identification by the classifier. Advantages and disadvantages of each classifier in traditional machine learning are avoided by adopting an integrated learning method, and meanwhile, the effectiveness of malicious behavior recognition can be better reflected by utilizing dynamic behaviors as features.

Description

technical field [0001] The invention relates to the fields of network security and information security detection, in particular to a software malicious behavior identification method based on integrated learning and dynamic analysis. Background technique [0002] With the development of information technology, the complexity of software is getting higher and higher, and people's dependence on software is becoming stronger and stronger. Many illegal program developers also aimed at this market, and developed many malicious programs to inject software to make huge profits, seriously infringing on the information security of users. Most of the traditional software detection methods rely on feature libraries, which makes it very difficult to face increasingly complex software. How to effectively identify malicious behaviors in malware and protect users' personal interests has become a hot topic today. Scholars and research organizations at home and abroad are actively involve...

Images