Malware detection method based on semantic analysis and bidirectional encoding representation

Abstract

The present application aims at the problem of ambiguous word representation and lack of context semantics in traditional model detection of malicious code, and proposes a malware detection method based on semantic analysis and bidirectional encoding representation, which combines BERT with convolution recurrent network based on external attention mechanism, uses malware API function call sequence as the feature of model learning, and performs static analysis to detect existing malware; the API call function sequence has correlation in context and semantics, BERT is used for word representation task, and semantic information is received from the sequence; the convolutional neural network and the long short-term memory network are respectively used for completing secondary feature extraction and API function chain relationship mining; and the attention mechanism is added after the long short-term memory network, so that the key information in the text can be better focused, the influence of noise is reduced, and the accuracy in the text classification task is improved; the present application is not affected by the change and deformation of malicious code itself, and the accuracy reaches 98.81%.

Images