PE file header feature-based malicious software detection method

Abstract

The invention discloses a malicious software detection method based on PE file header features, and relates to the technical field of security, and the method comprises the following steps: S100, preparing a file data set; s200, filtering the file data set; s300, extracting file header features; s400, adding a tag attribute; s500, selecting and training a classification model; and S600, PE file detection is carried out. According to the method, the multiple file header features are extracted from the PE file, the label attributes are added, malicious software is judged according to the label attributes, the false alarm rate is reduced, and the detection speed is increased.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a malware detection method based on PE file header features. Background Art

[0002] With the rapid development of computer and Internet technology, computer systems play an indispensable role in our daily lives. Users download software from various websites, bringing network security risks. Malware (Malicious Software, Malware) is one of the most common network attacks. It installs software that infringes on the legitimate interests of users on their computers without their permission. Malware affects the victim's computer in a variety of ways, including manipulating the computer's data, encrypting sensitive data, and disrupting the normal operation of the computer. In 2020, Kaspersky detected an average of 360,000 malware every day, of which more than 90% were PE (Portable Executable) files in the Windows operating system. PE files are executable files based on the Windows operating system, including file types with suffixes such as EXE, DLL, OCX, SYS, and COM. Therefore, malware analysis of WINDOWS PE files is of great significance.

[0003] Generally speaking, malware analysis methods can be divided into two categories: static analysis and dynamic analysis. In static analysis, the file itself is not executed, but the file structure information, file header data, specific strings, etc. are extracted to determine whether it is malware. Dynamic analysis executes malware in a controlled environment and monitors its behavior, system interactions, and network activities.

[0004] The traditional static detection method is also called signature matching. It calculates the hash value of the file and then matches it with the known hash value in the database. If the match is successful, it is judged as malware. The advantage of this method is that it has a fast calculation speed and can be seamlessly integrated into any detection system. It has almost no impact on performance and is suitable for large-scale sample detection. The disadvantage is that this method can only detect known malicious samples and is powerless against new or variant samples. And even for known samples, attackers only need to modify part of the signature to generate completely different hash values, resulting in detection failure. As time goes by, maintaining and repairing malware databases will become more and more complicated. In recent years, the number of malware samples has grown rapidly, and malware developers have used obfuscation methods to evolve different types of malware. The hash value of malware that has been obfuscated will also change accordingly, that is, variant malware, and the old hash signature value detection method will also become invalid.

[0005] In order to improve the signature strategy to deal with the shortcomings of new malicious samples, the industry has proposed an analysis method based on string rules. The more popular one is the YARA rule. It identifies malware by detecting the string features of files. These rules contain string features of some common malware. YARA rules are more effective than signature matching in dealing with some variant malware. However, with the continuous development of malware, old YARA rules often become invalid. And writing new rules requires strong expertise and reverse engineering technology. In addition, inappropriate rule matching will also lead to a high false alarm rate.

[0006] In addition to static analysis technology, dynamic analysis technology uses virtualization tools such as VirtualBox or VMware to create a virtualized environment, deploy suspicious samples in the virtual environment and activate them, so as to capture the behavior of suspicious samples when they are running. When malware runs in a virtualized environment, it will generate malicious behaviors such as API function calls, create or delete files, access websites and ports, change registry entries, download adware, etc. These behaviors are usually recorded after the software is running. Dynamic analysis can fully analyze the behavioral characteristics of samples, but its disadvantages are also obvious. First, malware developers often use a variety of sandbox countermeasures to evade detection in virtual environments. Secondly, malware often uses methods such as applying normal software digital signatures and reusing normal software codes to disguise host behavior, and uses virtual machine penetration technology to attack the host. Finally, the dynamic analysis method is complex to extract features, takes a long time to detect, and occupies more system resources. When applied to large-scale data, the disadvantages of this method are particularly prominent.

[0007] Therefore, technicians in this field are committed to developing a malware detection method based on PE file header features. Summary of the invention

[0008] In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is how to overcome the insufficiency of the traditional static analysis method in detecting variant malware and the time-consuming problem of sample analysis.

[0009] This application extracts multiple features of the PE file header, trains a classification model, and then uses the trained classification model to detect malware for unknown samples (i.e., PE files to be detected). The applicant analyzes the PE file header as follows: The NT Header is the core part of the PE file format. It contains information about how to load and execute the program and some important file attributes. The first part of the NT Header is the NT Signature, which contains the ASCII code of the letters "PE" to further confirm the legitimacy of the file format. The second part of the NT Header is the File Header, in which a key field is NumberOfSections, which records the total number of sections in the file. When the number of sections changes, the value will be updated accordingly. In the NT Header, the Optional Header is a crucial part and is an indispensable core component of the PE file. The Optional Header contains key information such as the program entry point address (AddressOfEntryPoint) and the code segment size (SizeOfCode). In addition, it also provides directory entries pointing to key data structures such as the import table, export table, and resource table.

[0010] The Section Table, following the NT Header, describes the information of each section in detail. Each section header in the Section Table defines the offset address (PointerToRawData) of the section in the file and its virtual address (VirtualAddress) in the memory. When the file is loaded into the memory by the loader, the loader maps the file content to the correct memory location according to these attributes to ensure the normal operation of the program.

[0011] The applicant conducted an in-depth study of multiple features of the PE file header, including: Checksum, located in the optional header of each PE file header, is used for integrity check of PE files. The checksum is a fixed-size number obtained by calculating the sum of the values ​​of all or part of the bytes of the file and then performing some form of processing. Malware often sets the value of this field to 0 to avoid possible integrity checks. Benign software must have a non-zero value for this field.

[0012] Text Entropy and Data Entropy are used to measure the confusion or uncertainty of information. Many malware programs use packing technology, which is one of the most common obfuscation techniques used by malware writers, making sample analysis more difficult. However, packing will obviously lead to an increase in entropy. So entropy can be used as an indicator of malware programs. Although some benign software also uses packing technology, the goal is to prevent reverse engineering, protect intellectual property, or reduce file size.

[0013] Number of Standard Sections, also known as sections or segments, is the basic unit of executable files. Each PE file consists of one or more standard sections, each of which contains different types of code, data, and other resources. Standard sections provide information to the linker and loader about how to handle the contents of the file, and allow the operating system to effectively manage the program layout in memory. Standard sections are defined as [".text", ".data", ".rdata", ".idata", ".edata", ".pdata", ".bss", "rsrc", ".reloc", ".debug"], where the ".text" segment contains the executable code of the program, the ".data" segment contains initialized data, the ".rdata" segment contains read-only data, the ".idata" segment contains other functions that the program needs to import, the ".edata" segment contains functions that the file can export, the ".pdata" segment contains exception location information, the ".bss" segment contains uninitialized data, the "rsrc" segment contains resource information, the ".reloc" segment contains relocation information, and the ".debug" segment contains debugging information. The above are the names of the standard sections commonly used in PE files. The number of standard sections refers to the number of segments that meet the standard section names. According to statistics, the number of successful matches for benign software is generally 3 to 4, while the number for malicious software is generally less than 2.

[0014] Number of non-standard sections (NumberOfNonStandardSections): Sections that are not in the standard section list are called non-standard sections. Benign software often stores security information in specific sections, while malware uses non-standard sections to hide malicious code and encrypted information. According to statistics, the number of matching non-standard sections in PE files is generally 0~2 for benign software, while most malware is greater than 2.

[0015] Number of Empty Sections: Empty sections are a simple and effective encryption and obfuscation method. Malware often uses empty sections to hide the true intention of the code. According to statistics, benign software does not have empty sections. Empty sections can only be malware.

[0016] Number of Multiple ExecSections: Malware can use multiple executable sections to hide its malicious code and make it difficult to detect. For example, a seemingly normal section may contain malicious code, while another section is responsible for triggering execution. By spreading malicious code across multiple sections, malware can try to bypass signature-based detection methods or make static analysis more difficult. According to statistics, benign software has only 1 to 2 sections with executable permissions at most, while malware often has more than 2.

[0017] In one embodiment of the present application, a malware detection method based on PE file header features is provided, comprising the following steps: S100, preparing a file data set, collecting files containing both benign software and malicious software, and obtaining a file data set; S200, filtering the file data set, screening and removing non-PE files from the file data set, retaining PE files, and obtaining a PE file data set; S300, extracting file header features, extracting file header features of the filtered file data set, and saving them to obtain a feature data set; S400, adding label attributes, adding label attributes to the feature data set to obtain a label feature data set; S500, selecting and training a classification model, selecting a classification model, dividing the label feature data set into a training set and a test set, and training and verifying the classification model; S600, PE file detection, using the trained classification model to detect the PE file to be detected, and output the detection result.

[0018] Optionally, in the malware detection method based on PE file header features in the above embodiment, the source of benign software is all PE files of the application category in the C:\Windows\System32 folder directory.

[0019] Optionally, in the malware detection method based on PE file header features in any of the above embodiments, the source of the malware can be downloaded from a related website.

[0020] Furthermore, in the malware detection method based on PE file header features in the above embodiment, the relevant website is https: / / virusshare.com / torrents.

[0021] Optionally, in the malware detection method based on PE file header features in any of the above embodiments, the method for screening non-PE files in step S200 is to check the file suffix and filter out files that do not have a PE file suffix.

[0022] Optionally, in the malware detection method based on PE file header features in any of the above embodiments, the file header features include checksum, text entropy, data entropy, number of standard sections, number of non-standard sections, number of empty sections, and number of multiple executable sections.

[0023] Optionally, in the malware detection method based on PE file header features in any of the above embodiments, the label attribute includes a malware label and a benign software label, the malware label is 1, and the benign software label is 0.

[0024] Optionally, in the malware detection method based on PE file header features in any of the above embodiments, the classification model includes a KNN (K-nearest neighbor algorithm) model, a random forest model, and a SVM (support vector machine) model.

[0025] Preferably, in the malware detection method based on PE file header features in the above embodiment, the classification model uses a random forest model.

[0026] Furthermore, in the malware detection method based on PE file header features in the above embodiment, step S500 includes: S510, select a classification model, and choose to use a random forest model; S520, divide the label feature data set, generate a training set and a test set according to a specified ratio, extract samples from the training set by random sampling with replacement, generate M training subsets, each training subset is used to train a separate decision tree, and select a parameter combination used for training; S530, defining a training stop condition, defining a training stop condition for a decision tree in a random forest model; S540, training the decision tree, determining the parameter values ​​in the parameter combination, training the decision tree, and completing the decision tree training when the training stop condition of the decision tree is met; S550, training the random forest model, looping through steps S540 to S550, taking a different training subset from the M training subsets each time, until all decision trees in the random forest model are trained, and the training of the random forest model under the parameter values ​​in the above parameter combination is completed; S560, updating the parameter values ​​in the parameter combination, updating the parameter values ​​in the parameter combination, and looping through steps S530 to S560 until all parameter values ​​in the parameter combination are traversed; S570, selecting the optimal random forest model, using the test set to verify the random forest model, comparing the detection results of the random forest model with the label attributes, and taking the random forest model with the highest detection accuracy as the optimal random forest model, and its parameter combination as the optimal parameter combination.

[0027] Furthermore, in the malware detection method based on PE file header features in the above embodiment, the ratio specified in step S520 is training set: test set = 7:3.

[0028] Furthermore, in the malware detection method based on PE file header features in the above embodiment, the training subset M=100 in step S520.

[0029] Furthermore, in the malware detection method based on PE file header features in the above embodiment, the number of samples in each training subset in step S520 is the same as the number of samples in the training set.

[0030] Furthermore, in the malware detection method based on PE file header features in the above embodiment, the parameter combination in step 520 includes the maximum depth of the decision tree and the minimum number of samples of a single node.

[0031] Furthermore, in the malware detection method based on PE file header features in the above embodiment, the training stop condition of the decision tree is to reach the maximum depth of the decision tree or be less than or equal to the minimum number of samples of a single node.

[0032] Furthermore, in the malware detection method based on PE file header features in the above embodiment, the maximum depth of the decision tree ranges from 10 to 20, and the minimum number of samples of a single node is 2 to 4.

[0033] Preferably, in the malware detection method based on PE file header features in the above embodiment, the maximum depth of the decision tree is 20, and the minimum number of samples of a single node is 2.

[0034] Furthermore, in the malware detection method based on PE file header features in the above embodiment, step S540 includes: S541, determine the training node, determine the parameter value in the parameter combination, take the root node as the training node, and start training the decision tree; S542, determine possible split points, randomly select a specified number of file header features for the training node, sort all feature values ​​under the file header feature from small to large for each selected file header feature, remove duplicate feature values, and use the middle value of adjacent feature values ​​as a possible split point. For example, if the feature value of a file header feature is {0, 1, 2, 3}, then 0.5, 1.5, and 2.5 are possible split points; S543, calculate the weighted Gini index, traverse all possible split points, and at each possible split point, convert the current training subset D Divide into sets and collection ,gather The eigenvalues ​​in are all smaller than the possible split point, and the set The eigenvalues ​​in are all greater than or equal to the possible split point. For example, the eigenvalues ​​of a file header feature are {0, 1, 2, 3}. When the possible split point is 1.5, the set and collection are {0, 1} and {2, 3} respectively; then the weighted Gini index of each possible split point is calculated as follows: in, and Separately and collection The number of samples in the current training subset D The ratio of the number of samples, are possible split points, and Separately and collection The Gini index is as follows: in, is the label attribute (malware label is 1, benign software label is 0), and The tag attributes are in the collection and collection The proportion of C is the number of tag attributes, C =2; S544, determining the best segmentation point, and selecting the possible segmentation point with the smallest weighted Gini index as the best segmentation point; S545, split the training subset, and take the set corresponding to the best segmentation point and collection Assign to the left and right child nodes respectively; S546, complete the decision tree training, take each left and right child node as a training node, repeat steps S542-S546 until the training stop condition of the training tree is met, and the training nodes that meet the training stop condition of the training tree are marked as leaf nodes, that is, nodes without left and right child nodes, and no longer continue to be split, thus completing the decision tree training.

[0035] Furthermore, in the malware detection method based on PE file header features in the above embodiment, the range of the specified number in step S542 is 3 or 4.

[0036] Preferably, in the malware detection method based on PE file header features in the above embodiment, the specified number in step S542 is 3.

[0037] Optionally, in the malware detection method based on PE file header features in any of the above embodiments, step S600 includes: S610, extracting file header features, extracting file header features of the PE file to be detected; S620, detecting file header features, inputting the header file features into the optimal random forest model, detecting the file header features of the PE file to be detected, and returning the tag attributes; S630: Output the detection result, count all the returned tag attributes, and output the tag attributes with the largest number as the detection result.

[0038] This application extracts multiple file header features from PE files and adds label attributes. It uses a trained classification model to judge malware based on label attributes, reducing the false alarm rate and improving the detection speed. It also has powerful detection capabilities for unseen variant malware and has a fast detection speed, and can complete the detection of unknown samples within 1 second.

[0039] The concept, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings to fully understand the purpose, characteristics and effects of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 is a flow chart illustrating a malware detection method based on PE file header features according to an exemplary embodiment. DETAILED DESCRIPTION

[0041] The following describes several preferred embodiments of the present invention with reference to the drawings in the specification, so that the technical content is clearer and easier to understand. The present invention can be embodied in many different forms of embodiments, and the protection scope of the present invention is not limited to the embodiments mentioned in the text.

[0042] In the drawings, components with the same structure are indicated by the same numerical reference numerals, and components with similar structures or functions are indicated by similar numerical reference numerals. The size and thickness of each component shown in the drawings are arbitrarily shown, and the present invention does not limit the size and thickness of each component. In order to make the illustration clearer, the thickness of the components is schematically exaggerated in some places in the drawings.

[0043] The inventors have designed a malware detection method based on PE file header features, such as Figure 1 As shown, the following steps are included: S100, prepare a file data set, collect files containing both benign software and malware, and obtain a file data set; the source of the benign software is all PE files of the application category in the C:\Windows\System32 folder directory, and the source of the malware is https: / / virusshare.com / torrents.

[0044] S200, filtering the file data set, filtering and removing non-PE files from the file data set, retaining PE files, and obtaining a PE file data set; the method of filtering the non-PE files is to check the file suffix name, and filtering the files that do not have the PE file suffix name.

[0045] S300, extracting file header features, extracting file header features of the filtered file data set, and saving them to obtain a feature data set, the file header features include checksum (Checksum), text entropy (TextEntropy), data entropy (DataEntropy), standard section number (NumberOfStandardSections), non-standard section number (NumberOfStandardSections), empty section number (NumberOfEmptySections), multiple executable sections number (NumberOfMultipleExecSections).

[0046] S400 , adding label attributes, adding label attributes to the feature data set to obtain a label feature data set, the label attributes include a malware label and a benign software label, the malware label is 1, and the benign software label is 0.

[0047] S500, select and train a classification model, the classification model uses a random forest model, divides the label feature data set into a training set and a test set, and trains and verifies the classification model; specifically includes: S510, select a classification model, and choose to use a random forest model.

[0048] S520, divide the label feature data set, generate a training set and a test set according to the specified ratio, the specified ratio is training set: test set = 7:3, extract samples from the training set by random sampling with replacement, generate M training subsets, M = 100, each training subset is used to train a separate decision tree, select the parameter combination used for training, the parameter combination includes the maximum depth of the decision tree and the minimum number of samples for a single node; the number of samples in each training subset is the same as the number of samples in the training set. S530, define a training stop condition, define a training stop condition for the decision tree in the random forest model, the training stop condition for the decision tree is to reach the maximum depth of the decision tree or be less than or equal to the minimum number of samples for a single node, the maximum depth of the decision tree is 20, and the minimum number of samples for a single node is 2.

[0049] S540, training a decision tree, determining parameter values ​​in a parameter combination, training the decision tree, and completing the decision tree training when a training stop condition of the decision tree is met; specifically including: S541, determine the training node, determine the parameter value in the parameter combination, take the root node as the training node, and start training the decision tree; S542, determine possible split points, randomly select 3 file header features for the training node, sort all feature values ​​under each selected file header feature from small to large, remove duplicate feature values, and use the middle value of adjacent feature values ​​as possible split points. For example, if the feature value of a file header feature is {0, 1, 2, 3}, then 0.5, 1.5 and 2.5 are possible split points; S543, calculate the weighted Gini index, traverse all possible split points, and at each possible split point, convert the current training subset D Divide into sets and collection ,gather The eigenvalues ​​in are all smaller than the possible split point, and the set The eigenvalues ​​in are all greater than or equal to the possible split point. For example, the eigenvalues ​​of a file header feature are {0, 1, 2, 3}. When the possible split point is 1.5, the set and collection are {0, 1} and {2, 3} respectively; then the weighted Gini index of each possible split point is calculated as follows: in, and Separately and collection The number of samples in the current training subset D The ratio of the number of samples, are possible split points, and Separately and collection The Gini index is as follows: in, is the label attribute (malware label is 1, benign software label is 0), and The tag attributes are in the collection and collection The proportion of C is the number of tag attributes, C =2; S544, determining the best segmentation point, and selecting the possible segmentation point with the smallest weighted Gini index as the best segmentation point; S545, split the training subset, and take the set corresponding to the best segmentation point and collection Assign to the left and right child nodes respectively; S546, complete the decision tree training, take each left and right child node as a training node, repeat steps S542-S546 until the training stop condition of the training tree is met, and the training nodes that meet the training stop condition of the training tree are marked as leaf nodes, that is, nodes without left and right child nodes, and no longer continue to be split, thus completing the decision tree training.

[0050] S550, training the random forest model, looping through steps S540 to S550, taking a different training subset from the M training subsets each time, until all decision trees in the random forest model are trained, and the training of the random forest model under the parameter values ​​in the above parameter combination is completed.

[0051] S560, updating the parameter values ​​in the parameter combination, updating the parameter values ​​in the parameter combination, and looping through steps S530 to S560 until all parameter values ​​in the parameter combination are traversed; S570, selecting the optimal random forest model, using the test set to verify the random forest model, comparing the detection results of the random forest model with the label attributes, and taking the random forest model with the highest detection accuracy as the optimal random forest model, and its parameter combination as the optimal parameter combination.

[0052] S600, PE file detection, uses the trained classification model to detect the PE file to be detected and outputs the detection results, including: S610, extracting file header features, extracting file header features of the PE file to be detected; S620, detecting file header features, inputting the header file features into the optimal random forest model, detecting the file header features of the PE file to be detected, and returning the tag attributes; S630: Output the detection result, count all the returned tag attributes, and output the tag attributes with the largest number as the detection result.

[0053] In order to verify the technical effect of this application, the applicant conducted an experiment. The software and hardware environment used in the experiment is as follows: Software environment: The hardware environment is a PC, and the main parameters are as follows: The verification process is as follows: 1. Obtain benign software from the \Windows\System32 folder directory and download malware from the https: / / virusshare.com / torrents website. After screening, 3,300 benign software and 5,500 malware were found; 2. Set the parameters of random forest, the training subset M is 100, the maximum depth of decision tree is 20, and the minimum number of samples for a single node is 2; 3. Use the trained random forest model and verify it with the test set. The average detection time of PE files in the test set is 0.5s. The detection indicators are shown in the following table: The explanations of the indicators in the table are as follows: Precision refers to the ratio of PE files (whether malware or normal software) correctly identified by the system to the total number of PE files detected in malware detection. The higher the precision, the higher the detection accuracy. Recall refers to the ratio of malicious PE files that the system can correctly identify to the total number of actual malicious PE files. The higher the recall rate, the stronger the ability to identify malware. F1-Score combines the precision and recall by harmonic averaging. The specific calculation formula is: F1-Score = 2 * (precision * recall) / (precision + recall). The higher the F1-Score, the better the overall detection performance.

[0054] It can be seen from the table data that the present invention has achieved the expected technical effect.

[0055] The preferred specific embodiments of the present invention are described in detail above. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A malware detection method based on PE file header features, characterized in that: The following steps are involved: S100, preparing a file data set, collecting files containing both benign software and malicious software, and obtaining a file data set; S200, filtering the file data set, screening and removing non-PE files from the file data set, retaining PE files, and obtaining a PE file data set; S300, extracting file header features, extracting file header features of the PE file data set, and saving them to obtain a feature data set; S400, adding a label attribute, adding a label attribute to the feature data set to obtain a label feature data set; S500, selecting and training a classification model, selecting a classification model, dividing the label feature data set into a training set and a test set, and training and verifying the classification model; S600, PE file detection, using the trained classification model to detect the PE file to be detected, and output the detection result.

2. The malware detection method based on PE file header features as claimed in claim 1, characterized in that: The method for filtering non-PE files in step S200 is to check the file extensions and filter out files that do not have PE file extensions.

3. The malware detection method based on PE file header features as claimed in claim 1, characterized in that: The file header features include checksum, text entropy, data entropy, number of standard sections, number of non-standard sections, number of empty sections, and number of multiple executable sections.

4. The malware detection method based on PE file header features as claimed in claim 3, characterized in that: The label attribute includes a malware label and a benign software label, the malware label is 1, and the benign software label is 0.

5. The malware detection method based on PE file header features as claimed in claim 4, characterized in that: The classification model uses a random forest model.

6. The malware detection method based on PE file header features as claimed in claim 5, characterized in that: The step S500 includes: S510, selecting a classification model, and choosing to use the random forest model; S520, dividing the label feature data set, generating a training set and a test set according to a specified ratio, extracting samples from the training set by random sampling with replacement, generating M training subsets, each training subset is used to train a separate decision tree, and selecting a parameter combination used for training; S530, defining a training stop condition, defining a training stop condition for a decision tree in the random forest model; S540, training a decision tree, determining parameter values ​​in a parameter combination, training the decision tree, and completing the decision tree training when a training stop condition of the decision tree is met; S550, training the random forest model, looping through the steps S540 to S550, taking a training subset different from the previous one from the M training subsets each time, until all decision trees in the random forest model are trained, thus completing the training of the random forest model under the parameter values ​​in the parameter combination; S560, updating the parameter values ​​in the parameter combination, updating the parameter values ​​in the parameter combination, and executing the steps S530 to S560 until all parameter values ​​in the parameter combination are traversed; S570, selecting an optimal random forest model, using the test set to verify the random forest model, comparing the detection result of the random forest model with the label attribute, and taking the random forest model with the highest detection accuracy as the optimal random forest model, and its parameter combination as the optimal parameter combination.

7. The malware detection method based on PE file header features as claimed in claim 6, characterized in that: The training stopping condition of the decision tree is to reach the maximum depth of the decision tree or be less than or equal to the minimum number of samples of a single node.

8. The malware detection method based on PE file header features as claimed in claim 7, characterized in that: The maximum depth of the decision tree is in the range of 10-20, and the minimum number of samples of a single node is 2-4.

9. The malware detection method based on PE file header features as claimed in claim 8, characterized in that: The step S540 includes: S541, determining a training node, determining a parameter value in a parameter combination, taking a root node as the training node, and starting to train the decision tree; S542, determining possible segmentation points, randomly selecting a specified number of file header features for the training node, and for each selected file header feature, sorting all feature values ​​under the file header feature from small to large, removing duplicate feature values, and taking the middle value of adjacent feature values ​​as the possible segmentation point; S543, calculate the weighted Gini index, traverse all the possible segmentation points, and at each possible segmentation point, convert the current training subset D Divide into sets and collection , the set The eigenvalues ​​in are all smaller than the possible split point, and the set The eigenvalues ​​in are all greater than or equal to the possible segmentation points; then the weighted Gini index of each possible segmentation point is calculated, and the formula is as follows: ； S544, determining the best segmentation point, and selecting the possible segmentation point with the smallest weighted Gini index as the best segmentation point; S545, split the training subset, and take the set corresponding to the best segmentation point and collection Assign to the left and right child nodes respectively; S546, complete the decision tree training, take each left and right child node as the training node, repeat the steps S542 to S546 until the training stop condition of the training tree is met, and the training nodes that meet the training stop condition of the training tree are marked as leaf nodes, that is, nodes without left and right child nodes, and no longer continue to be split, thus completing the decision tree training.

10. The malware detection method based on PE file header features as claimed in claim 9, characterized in that: The step S600 includes: S610, extracting file header features, extracting file header features of the PE file to be detected; S620, detecting file header features, inputting the header file features into the optimal random forest model, detecting the file header features of the PE file to be detected, and returning tag attributes; S630: Output the detection result, count the returned tag attributes, and output the tag attributes with the largest number as the detection result.

Images