Botnet software detection method based on API calling and network behaviors

Abstract

The invention discloses a zombie software detection method based on API (Application Program Interface) calling and network behaviors. The method comprises a host behavior pattern extraction layer module, a network behavior pattern extraction layer module and an aggregation training module, wherein the host behavior pattern extraction layer module comprises a file analysis and identification sub-module, a static FCG extraction sub-module, a sample distribution sub-module and a call context extraction sub-module, and sequentially performs analysis and identification of sample files, sample distribution, static analysis and dynamic analysis of samples, FCG call graph compression and node re-tagging; the network behavior mode advance layer module comprises a network behavior monitoring and data preprocessing sub-module and an LSTM representation learning sub-module, and is used for carrying out network behavior collection and data preprocessing and training the LSTM representation learning sub-module; and the aggregation training module performs aggregation training on output data of the host behavior pattern extraction layer module and the network behavior pattern extraction layer module, inputs the output data into the full-connection classification network, and finally obtains a classification result.

Description

technical field

[0001] The invention relates to the technical field of computer science, in particular to a method for detecting zombie software based on API calling and network behavior. Background technique

[0002] With the application of deep learning, end-to-end natural language processing-based text classification techniques and learning models are also applied in malicious code detection. X.Xiao and others regard binary code as the lowest-level feature. The binary code is similar to the image pixels or the first few bytes of traffic in other applications of deep learning, and then uses CNN, RNN or LSTM, auto-encoder, etc. to mine the code structure or time series The features on the upper layer are learned through multiple hidden layers to learn more advanced features. M.Yeo first extracts the features and inputs them into the neural network for training and classification, because the traffic sent by malicious codes such as botware often has different characteristic...

Images