Malicious code classification method and device, electronic equipment and medium

Abstract

The invention provides a malicious code classification method and device, electronic equipment and a medium, and relates to the technical field of network and information security. The malicious code classification method comprises the following steps: performing visualization processing on a pre-classified malicious code file to obtain a pre-classified malicious code image; inputting the malicious code image into a convolutional neural network model, and processing the malicious code image into a classification feature vector with a uniform size based on a spatial pyramid pooling layer of the convolutional neural network model; and carrying out model iteration training on the convolutional neural network model based on the classification feature vector so as to obtain a classification model of the malicious code image based on the model iteration training. According to the technical scheme, by means of the characteristic that the image features of the malicious codes of the same family have similarity, the spatial pyramid pooling is introduced, and the reliability of performing family recognition on the malicious code file through the obtained family classification model can be guaranteed.

Description

technical field [0001] The present disclosure relates to the technical field of network and information security, and in particular, to a malicious code classification method, device, electronic device and storage medium. Background technique [0002] Due to the influence of external factors, many companies have set up a remote office mode. The popularity of the remote office mode has gradually increased the number and frequency of network transmission of electronic documents, and the widespread use of electronic documents has created environmental conditions for the spread of malicious codes. , the types and bad effects of malicious code are also gradually increasing. [0003] Because malicious code is usually iterated by a malicious code team based on a certain malicious code, for example, the author of the malicious code confuses the characteristics of the existing malicious code through technical means such as deformation, packing, and polymorphism, thereby generating ne...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present disclosure is to provide a malicious code classification method, device, storage medium and electronic equipment, at least to a certain extent, to overcome the problem of poor identification of the family of malicious codes in the related art

Images