Detecting method and system for malicious codes

Abstract

The invention provides a detecting method and a system for malicious codes, which are assisted by an OLAP engine, characterized by interaction behaviors of a main control end and a controlled end of malicious codes and are based on excavation, wherein the detecting method comprises a step 101 of detecting a network; a step 201 of extracting suspicious main control end behaviors; steps 301-303 of expanding a training set; a step 401 of training a classifier; a step of 501 of brushing Cube; steps 601-606 of excavating sequences; and a step 701 of generating a rule. The detecting system comprises a detecting module, a training sample pool, an SVM classifier, a relation database, an OLAP engine, a characteristic sequence excavation engine and a knowledge base.

Description

technical field [0001] The invention relates to a malicious code detection method and system thereof, more specifically, to a mining-based malicious code detection method and a malicious code network behavior characteristic analysis and detection system. Background technique [0002] With the popularity of the Internet, information security has become more and more important, and information security has also become an important research field that has attracted much attention. Due to the flaws in the design of the Internet itself and its openness, it is extremely vulnerable to attacks. In Internet security incidents, economic losses caused by malicious codes account for the largest proportion. At the same time, malicious codes have become an important means of information warfare and network warfare. What's more, the types of malicious codes, propagation speed, number of infections and scope of influence are gradually increasing. [0003] In terms of detecting malicious c...

AI Technical Summary

Problems solved by technology

This method has a low false positive rate, but it must first obtain its characteristics before detecting a malicious code, which increases the possibility of the computer system being infected and attacked

Emerging malicious codes are also becoming more and more complex. By adopting fuzzy transformation technologies such as polymorphism and deformation, the survivability of malicious codes has been enhanced, and tools based on signature detection technology are generally unable to identify them. brought great challenges

Images