Mining type malicious code robustness detection method and system based on integration strategy and medium

Abstract

The invention discloses a mining type malicious code robustness detection method and system based on an integration strategy and a medium. The method comprises the steps: reading a character string of a binary file through a static analysis method; carrying out feature vectorization through a TF-IDF algorithm; obtaining a training sample; randomly extracting a training sample by adopting a Bagging strategy; training a model by adopting a Boosting strategy according to the extracted training sample, and performing prediction; and taking an average value of predicted results after multiple times of training. According to the method and system, an existing static analysis method is improved, only the character string distribution characteristics of the mining type malicious codes are concerned, and characteristic engineering is simple and rapid; besides, the detection model is designed by adopting an integration strategy, the thinking of Bagging and Boosting algorithms is fused, the process of constructing the detection model is simple, the prediction speed is high, the accuracy is high, the robustness of the model is improved, and the prediction result is more accurate and stable.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a mining-type malicious code robustness detection method, system and medium based on an integrated strategy. Background technique [0002] Malicious code is harmful computer code or web scripts designed to create system vulnerabilities and thereby cause backdoors, security risks, information and data theft, and other potential damage to files and computer systems. Common malicious codes include computer viruses, computer worms, Trojan horses, and the like. Trojan horse (referred to as Trojan horse) is a class of programs that seem to have normal functions, but actually hide many functions that users do not want. As a specific type of Trojan horse, mining malicious code (also known as mining Trojan horse and mining virus) mainly earns profits by invading computer systems and implanting mining machines to earn encrypted digital currency. [0003] In recent ye...

AI Technical Summary

Problems solved by technology

Third, there are endless system-level vulnerabilities, which are easily exploited by malicious mining programs

The second is the harmful behavior of concealing profit

Existing static analysis methods require analysts to have a high professional level in order to extract effective features, and feature extraction will become extremely difficult in the case of file packing, resource confusion, etc.

However, the dynamic analysis method needs to monitor the behavior of program files in real time, resulting in the waste of a large amount of computing resources and inevitably causing a large time overhead.

Images