Malicious code detection method for safety protection of power enterprise

Abstract

The invention relates to a malicious code detection method for safety protection of a power enterprise, which comprises the steps of sampling an original data set by an instruction set generated by a system program, extracting malicious features by analyzing the content of samples and the relationship between the samples according to the features of the instruction set in the data set, performing taint marking on the instruction set by using a taint propagation analysis algorithm, constructing a behavior dependency graph, performing enhancement processing on the behavior dependency graph, constructing positive and negative example samples, performing comparative learning according to the obtained positive and negative sample data to generate enough samples, then forming an enhanced data set by using newly generated sample data and the original data set, inputting the enhanced data set into a comparative learning feature extractor taking the neural network as an encoder to learn representation features of the malicious codes, finally performing parameter adjustment and optimization on a loss function of the neural network through a back propagation algorithm, and storing a trained optimal model to detect and identify the malicious codes.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to a malicious code detection method used for security protection of electric power enterprises. Background technique [0002] With the improvement of the automation level of the power system, the enrichment of functions, the extension of the coverage of the dispatching data network, and the increase of users, the threats to the information security of the power system are becoming more and more diversified. Medium and high-risk vulnerabilities, medium-risk vulnerabilities, and low-risk vulnerabilities in the power industry accounted for 21%, 55%, and 24% respectively. Attackers can use high-risk vulnerabilities to obtain the control authority of the power industrial control terminal, arbitrarily modify the status of switches and other components, interrupt and interfere with normal power supply services, and use the industrial control terminal as a springboard to launch at...

AI Technical Summary

Problems solved by technology

[0008] In view of the above situation, in order to overcome the deficiencies in the prior art, the purpose of the present invention is to provide a malicious code detection method for the security protection of electric power enterprises, which can effectively improve the malicious code detection method of electric power enterprises for the weak protection ability of electric power enterprise security protection. Efficiency and accuracy of code detection

Images