Malicious software detection method and system based on N-gram and machine learning

Abstract

The invention provides a malicious software detection method and system based on N-gram and machine learning. The method comprises the steps of: performing dynamic behavior analysis on a sample file by combining a sandbox SNDBOX based on an artificial intelligence technology to obtain key information of the sample file, wherein the key information comprises API calling, parameter information and the like, and then the information is converted into a feature set by utilizing an N-gram algorithm; then using the TF-IDF to carry out the specification of the N-gram feature set, wherein the specified feature set only contains important features, thereby facilitating the improvement of the efficiency of subsequent training of a machine learning classifier; and finally, converting the feature set into binary feature vectors, and transmitting the binary feature vectors to a plurality of machine learning classifiers including naive Bayes, decision trees, random forests, logic protocols and the like for training and testing. The trained classifier can assist security analysts in detecting malicious software.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to a malicious software detection method and system based on N-gram and machine learning. Background technique [0002] Malware is any software that deliberately disrupts the normal functioning of a computer or network. Malware causes damage when planted or somehow gain access to a target computer and can take the form of executable code, scripts, active content and other software. Malware behaviors include stealing sensitive information, gaining unauthorized access to private systems, or espionage. Malware currently targets a wide range of individuals, from the IT systems of large organizations to national infrastructure such as nuclear power plants and water systems. Existing malware variants continue to evolve as malware developers continue to improve detection and evasion techniques. The latest SonicWall Cyber ​​Threat Report states that SonicWall services discover...

AI Technical Summary

Problems solved by technology

There are many types of anomaly-based detection algorithms, but most of them are difficult to meet the needs of practical applications in terms of accuracy and performance.

Images