Malicious code detection method based on malicious code dynamic forensic model

Abstract

The invention belongs to the technical field of network security, and particularly relates to a malicious code detection method based on a malicious code dynamic evidence obtaining model, which comprises the following specific steps of: 1, acquiring a code sequence flow to be detected; and step 2, based on a 3-Gram feature generation method and by utilizing a sliding window technology, sliding on the code sequence stream to extract a dynamic behavior feature vector of each sample to be detected. The initial detection of the code sequence is realized through the malicious code detection model, namely, the initial identification of malicious codes and non-malicious codes is realized; and clustering unknown sequences of the initially detected malicious codes by utilizing a clustering means, and further identifying whether the malicious codes are malicious codes or not by utilizing a mechanism that malicious code classifications corresponding to the samples to be detected in the same cluster should be consistent, so that the detection precision of the malicious codes is greatly improved through dual identification.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a malicious code detection method based on a malicious code dynamic forensics model. Background technique [0002] In recent years, with the increasingly fierce competition in cyberspace, the problem of network attacks with the background of countries or hacker organizations has become more and more serious, and the frequency of malicious code (also known as malware) attacks has increased exponentially. A series of cyber security incidents have caused serious threats to the country and society. Therefore, it is necessary to speed up the construction of a security guarantee system for key information infrastructure, to perceive the network security situation in an all-round way, and to enhance the ability of network security defense and deterrence. Emergency response and disposal is to take corresponding remedial measures and actions after malicious code invades the syst...

AI Technical Summary

Problems solved by technology

However, "the way is one foot high, the devil is one foot high", malicious attack technology is also constantly improving, malicious code through various "fragmentation", "encryption" and other anti-forensics methods, making it difficult to detect malicious code Disaster

At the same time, because the real-time emergency response mechanism for new malicious code is not perfect, the scope of influence of malicious code is getting wider and wider.

[0004] Most of the traditional network malicious code forensics technology focuses on the forensics of a given static malicious code data set in a specific background, and does not discuss the dynamic protection of newly added malicious code. Therefore, new or variant malicious code generated by malicious attackers When the traditional malicious code detection model cannot define and measure the dynamically evolving malicious code, it is difficult to provide an effective protection scheme

Images