Malware detection method and system based on artificial intelligence and storable medium
By combining software name, static characteristics and operation data, using artificial intelligence identification models for malware detection, the problem of low detection accuracy in the existing technology is solved, and the detection success rate is improved and the false alarm rate is reduced.
Patent Information
- Application Number
- CN202411545001.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-31
- Publication Date
- 2025-02-25
AI Technical Summary
The detection accuracy of existing malware detection is low and it cannot be effectively used in combination with the software's operating data and name.
Using a malware detection method based on artificial intelligence, we use an identification model to determine whether the software has malicious behavior by obtaining the installation package and software name of the software to be detected, combining static characteristics and operation data.
It improves the detection success rate of malware, reduces the false positive rate, and can detect malware more accurately.
Smart Images
Figure CN119513866A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and more specifically to an artificial intelligence-based malware detection method, system and storable medium. Background Art
[0002] Malware is currently defined as programs such as viruses, worms, and Trojan horses that perform malicious tasks on a computer system, taking control by disrupting software processes. Malware consists of a variety of threats, so methods and technologies are needed for anti-malware protection.
[0003] However, in the existing malware detection process, the relevant features of the software itself are used for detection, and the running data and name of the software are rarely combined for detection, resulting in the problem of low detection accuracy.
[0004] Therefore, how to provide a malware detection method that can solve the above problems is an issue that those skilled in the art need to solve urgently. Summary of the invention
[0005] In view of this, the present invention provides an artificial intelligence-based malware detection method, system and storable medium, which comprehensively consider the software name, static features and operation data during the software simulation operation to detect whether there is malicious behavior, which helps to improve the detection success rate and reduce the false alarm rate.
[0006] In order to achieve the above object, the present invention adopts the following technical solution:
[0007] An artificial intelligence-based malware detection method comprises the following steps:
[0008] Obtain the installation package and software name of the software to be detected;
[0009] Identify the software name and match the identification result with a preset malware name database, and if the match is successful, it indicates that the software to be detected is malware;
[0010] When the matching fails, the corresponding feature data is extracted from the software to be detected, and the feature data is processed, and it is determined whether the software to be detected is malicious software according to the feature data processing result.
[0011] Preferably, the specific process of determining whether the software to be detected is malware according to the characteristic data processing result includes:
[0012] Extracting static features from the software to be detected, and preprocessing the static features;
[0013] A recognition model is constructed, and the pre-processed static features are input into the recognition model for processing to obtain corresponding processing results, and whether the software to be detected is malicious software is determined based on the processing results.
[0014] Preferably, the specific processing process of judging whether the software to be detected is malware according to the characteristic data processing result further includes:
[0015] When the software to be detected is not identified as malicious software, establishing an isolated virtual space in the detection carrier;
[0016] Decompressing and running the installation package of the software to be detected in the virtual space to obtain corresponding operation data;
[0017] It is determined whether the running data contains any malicious actions; if so, the software to be detected is a malicious application.
[0018] Preferably, the specific processing process when there is no malicious action includes:
[0019] Extracting operation characteristics from the operation data, and preprocessing the operation characteristics;
[0020] Mixing the running features with the static features to form a detection data set;
[0021] The detection data set is input into the recognition model for processing, and whether the software to be detected is malware is determined according to the processing result.
[0022] Preferably, the specific process of matching the identification result with the preset malware name database includes:
[0023] Convert the software name into a character string, and convert the malware name contained in the preset malware name database into a corresponding preset character string;
[0024] The character string is matched with the preset character string in sequence, and when the matching result is greater than or equal to a preset threshold, it is determined that the match is successful.
[0025] The present invention also provides a detection system for a malware detection method based on artificial intelligence, comprising:
[0026] The acquisition module is used to obtain the installation package and software name of the software to be detected;
[0027] An identification module, used to identify the software name and match the identification result with a preset malware name database, and when the match is successful, it indicates that the software to be detected is malware;
[0028] The processing module is used to extract corresponding feature data from the software to be detected when the matching fails, process the feature data, and determine whether the software to be detected is malicious software according to the feature data processing result.
[0029] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the malware detection method as described in any one of the above items is implemented.
[0030] It can be seen from the above technical solutions that compared with the prior art, the present invention discloses a malware detection method, system and storable medium based on artificial intelligence, which identifies the software name of the software to be detected, determines whether to consider the static features of the software to be detected according to the identification results, and if necessary, uses the identification model to process the static features, and determines whether to consider the software's running data according to the processing results, and if necessary, uses virtual space to simulate the software running, and finally processes the software's running data. The full name of the present invention comprehensively considers the software's name, static features and running data during the software simulation running process to detect whether there is malicious behavior, which helps to improve the detection success rate and reduce the false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.
[0032] Figure 1 An overall flow chart of an artificial intelligence-based malware detection method provided by the present invention;
[0033] Figure 2 A structural principle block diagram of an artificial intelligence-based malware detection system provided by the present invention. DETAILED DESCRIPTION
[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0035] See also Figure 1 As shown, the embodiment of the present invention discloses a malware detection method based on artificial intelligence, comprising the following steps:
[0036] Obtain the installation package and software name of the software to be detected;
[0037] Identify the software name and match the identification result with the preset malware name database. If the match is successful, it means that the software to be detected is malware.
[0038] When the match fails, the corresponding feature data is extracted from the software to be detected, and the feature data is processed, and it is determined whether the software to be detected is malicious software based on the feature data processing result.
[0039] In a specific embodiment, the specific process of matching the identification result with the preset malware name database includes:
[0040] Convert the software name into a string, and convert the malware name contained in the preset malware name database into a corresponding preset string;
[0041] The character string is matched with the preset character string in sequence, and when the matching result is greater than or equal to the preset threshold, the match is judged to be successful.
[0042] In a specific embodiment, the specific process of determining whether the software to be detected is malware according to the characteristic data processing result includes:
[0043] Extract static features from the software to be detected and preprocess the static features, where the static features may include API call functions, application permissions, digital signature information, etc. The preprocessing process may include methods such as normalization and feature quantity balancing;
[0044] Construct a recognition model, and input the preprocessed static features into the recognition model for processing to obtain the corresponding processing results, and determine whether the software to be detected is malicious software based on the processing results.
[0045] In a specific embodiment, the specific processing process of determining whether the software to be detected is malware according to the characteristic data processing result further includes:
[0046] When the software to be detected is not identified as malware, an isolated virtual space is established in the detection carrier;
[0047] Decompress the installation package of the software to be tested in the virtual space and run it to obtain corresponding running data;
[0048] Determine whether there are malicious actions in the running data. If so, the software to be detected is a malicious application.
[0049] In a specific embodiment, when there is no malicious action, the specific processing process includes:
[0050] Extracting operation features from the operation data and preprocessing the operation features;
[0051] Mix the running features with the static features to form a detection data set;
[0052] The detection data set is input into the recognition model for processing, and whether the software to be detected is malware is determined based on the processing results.
[0053] Specifically, the operation characteristics may include: log feature data, memory utilization feature data, operation abnormality feature data and interaction feature data, among which the abnormal feature data includes whether there is any one or more of malicious hidden content, abnormal applications and abnormal links during the operation of the software to be detected. Including the above-mentioned abnormal feature data judgment results in the preprocessing process of the operation characteristics can better reflect the reliability of the feature data.
[0054] Specifically, the network structure of the recognition model may include an adaptive fuzzy learning module and a recurrent neural network connected in sequence, wherein the adaptive fuzzy learning module may include a fuzzy association unit and a node adjustment unit, and the node adjustment unit may be implemented through a node pruning strategy, and the fuzzy association unit is used to associate the data volume contained in the input detection data set (or static feature), and after the association, the number of nodes of the recurrent neural network is adjusted through the node adjustment unit, thereby obtaining a simpler structure and improving processing efficiency.
[0055] The training process of the recognition model can include the following steps:
[0056] Acquire a first static feature and a first dynamic feature of the benevolent software, and simultaneously acquire a second static feature and a second dynamic feature of the malicious software;
[0057] The first static feature and the first dynamic feature are mixed in a preset ratio to obtain a benevolent software feature, and the second static feature and the second dynamic feature are mixed in a preset ratio to obtain a malicious software feature;
[0058] Balance the sample categories of benign software features and malicious software features to form a training data set;
[0059] The training data set is divided into a training set and a test set in a certain ratio, and the recognition model is trained and verified. By mixing the features of benign software and malicious software and then training the recognition model, the recognition accuracy of the model can be improved.
[0060] See also Figure 2 As shown, an embodiment of the present invention further provides a detection system using an artificial intelligence-based malware detection method according to any one of the above embodiments, comprising:
[0061] The acquisition module is used to obtain the installation package and software name of the software to be detected;
[0062] The identification module is used to identify the software name and match the identification result with the preset malware name database. If the match is successful, it means that the software to be detected is malware;
[0063] The processing module is used to extract corresponding feature data from the software to be detected and process the feature data when the matching fails, and determine whether the software to be detected is malicious software based on the feature data processing result.
[0064] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the malware detection method as described in any one of the above embodiments is implemented.
[0065] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.
[0066] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A malware detection method based on artificial intelligence, characterized in that: The following steps are involved: Obtain the installation package and software name of the software to be detected; Identify the software name and match the identification result with a preset malware name database, and if the match is successful, it indicates that the software to be detected is malware; When the matching fails, the corresponding feature data is extracted from the software to be detected, and the feature data is processed, and it is determined whether the software to be detected is malicious software according to the feature data processing result.
2. The artificial intelligence-based malware detection method according to claim 1, characterized in that: The specific process of judging whether the software to be detected is malware according to the characteristic data processing result includes: Extracting static features from the software to be detected, and preprocessing the static features; A recognition model is constructed, and the pre-processed static features are input into the recognition model for processing to obtain corresponding processing results, and whether the software to be detected is malicious software is determined based on the processing results.
3. The artificial intelligence-based malware detection method according to claim 2, characterized in that: The specific processing process of judging whether the software to be detected is malware according to the characteristic data processing result also includes: When the software to be detected is not identified as malicious software, establishing an isolated virtual space in the detection carrier; Decompressing and running the installation package of the software to be detected in the virtual space to obtain corresponding operation data; It is determined whether the running data contains any malicious actions; if so, the software to be detected is a malicious application.
4. The method for detecting malware based on artificial intelligence according to claim 3, characterized in that: When there is no malicious action, the specific processing process includes: Extracting operation characteristics from the operation data, and preprocessing the operation characteristics; Mixing the running features with the static features to form a detection data set; The detection data set is input into the recognition model for processing, and whether the software to be detected is malware is determined according to the processing result.
5. The artificial intelligence-based malware detection method according to claim 1, characterized in that: The specific process of matching the identification results with the preset malware name database includes: Convert the software name into a character string, and convert the malware name contained in the preset malware name database into a corresponding preset character string; The character string is matched with the preset character string in sequence, and when the matching result is greater than or equal to a preset threshold, it is determined that the match is successful.
6. A detection system using the artificial intelligence-based malware detection method according to any one of claims 1 to 5, characterized in that: include: The acquisition module is used to obtain the installation package and software name of the software to be detected; An identification module is used to identify the software name and match the identification result with a preset malware name database. When the match is successful, it indicates that the software to be detected is malware; The processing module is used to extract corresponding feature data from the software to be detected when the matching fails, process the feature data, and determine whether the software to be detected is malicious software according to the feature data processing result.
7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the malware detection method according to any one of claims 1 to 5 is implemented.