Homologous analysis method and device for malicious codes and readable storage medium

Abstract

The invention discloses a homologous analysis method and device for malicious codes and a readable storage medium, and the method comprises the steps of obtaining malicious code samples which comprise different types of malicious codes; disassembling the malicious code sample to determine a corresponding assembly instruction sequence, where the assembly instruction sequence comprises a plurality of instructions, and the lengths of the plurality of instructions can be different; inputting a feature extraction model for prediction training on the basis of vectors corresponding to an instruction with a preceding sub-sequence and an instruction with a following sub-sequence and a vector corresponding to the malicious code sample; and extracting semantic features of unknown malicious code data by using the trained feature extraction model so as to carry out homologous analysis on malicious codes. The method can be suitable for homologous analysis of malicious codes with different lengths, and the problem that in the prior art, the input lengths are inconsistent due to the fact that the number of instructions in the codes is different is solved.

Description

technical field [0001] The invention relates to the field of information security, in particular to a malicious code homologous analysis method, device and readable storage medium. Background technique [0002] Malicious code homology analysis (Homology Analysis) is to analyze the correlation between malicious codes through the internal and external characteristics of malicious codes, as well as the rules of generation and propagation. There are various types of malicious code, including computer viruses, worms, Trojan horse programs, backdoor programs, logic bombs, etc. Each type of malicious code tends to have similarities in the following aspects: (1) functional code, in order to achieve the same malicious function, the key code fragments may be similar, and these similar code fragments are also called genetic codes, such as Duqu With Stuxnet, their DLL injection, RPC service and other key function codes are highly similar; (2) system function calls, the operation of mal...

AI Technical Summary

Problems solved by technology

[0004] Embodiments of the present invention provide a method, device, and readable storage medium for homologous analysis of malicious codes, which can be applied to homologous analysis of malicious codes of different lengths, and solve the problem of input lengths caused by different numbers of instructions in codes in the prior art Inconsistency

Images