Malicious code detection method and device and computer readable storage medium

Abstract

The invention provides a malicious code detection method. The method comprises the following steps: acquiring operation information of a to-be-detected malicious code file; inputting the operation information into a malicious code detection model which is trained by utilizing the characteristics of the heterogeneous network in advance, and outputting the category of the to-be-detected malicious code file; the malicious code detection model is trained through the following steps: S1, obtaining a file sample as a training set; s2, extracting operation information of the file sample; s3, constructing a heterogeneous network; s4, according to the heterogeneous network paradigms, obtaining a relation adjacency matrix of the heterogeneous network for each heterogeneous network paradigm, and obtaining a random walk vector; s5, using the random walk information to construct and train a corresponding word vector model and a classification model; and S6, performing principal angle weighting on the classification result to determine the category to which the malicious code file to be detected belongs. By means of the technical scheme, the environment information of the malicious codes is fully utilized, and the classification accuracy of the malicious code files is improved.

Description

technical field [0001] The present invention relates to the field of computer security, and in particular, to a malicious code detection method, device and computer-readable storage medium. Background technique [0002] Binary malicious code is a collective term for various types of malware, including viruses, Trojans, backdoors, worms, and more. Malicious codes have posed a great threat to the data security and property security of Internet companies and individual users. With the development of various development tools, the generation of malicious code has become simpler and the anti-detection capability has become stronger and stronger, which makes major anti-virus and security vendors face huge challenges. [0003] In the game with malicious code, the detection method of malicious code based on signature is the most commonly used analysis method. The feature code detection method refers to the method of obtaining code features from malicious code and using this featur...

AI Technical Summary

Problems solved by technology

However, the methods using machine learning tend to be more usable and interpretable. With the advent of a large number of efficient classifiers, the explanatory part of feature extraction and analysis schemes is ignored.

Images