Method and device for classifying malicious software

Abstract

The invention discloses a method and device for classifying malicious software to solve the problem that in the prior art, the accuracy is low when the malicious software is classified. The method includes the steps of setting up a virtual process corresponding to process information according to the process information which is generated in advance on the basis of feature behaviors of obtained malicious software; running malicious software to be classified, recording dynamic behaviors which are generated by the malicious software to be classified for set virtual installation records and the set virtual process; outputting the dynamic behaviors of the records to a malicious software classifying tool so that the malicious software classifying tool can classify the malicious software to be classified according to the recorded dynamic behaviors, wherein the virtual installation records are set up according to the software installation information which is generated in advance on the basis of the feature behaviors of the obtained malicious software.

Description

technical field [0001] The invention relates to the technical field of computer information security, in particular to a malware classification method and device. Background technique [0002] Malware is used to collectively refer to any variety of malicious programs including viruses, worms, Trojan horses, and spyware. In recent years, there has been less pure malware (such as malware that is purely for pranks or experiments) due to profit-driven relationships, and more malware with backdoors that allow attackers to remotely control malicious software. Malware of infected machines, machines infected by this kind of malware are often called "broilers", so this kind of malware is often called "broiler" type malware, and controlled networks composed of "broilers" are usually Known as "botnets", attackers usually use their own "botnets" to attack in distributed denial of service (Distributed Denial of Service, DDoS) attacks, bank card password theft, spam sending, and sensitiv...

AI Technical Summary

Problems solved by technology

[0006] Embodiments of the present invention provide a malware classification method and device to solve the problem of low accuracy in classifying malware in the prior art

Images