Malware detection visualization method and system based on malicious network traffic lexicon

Abstract

The invention discloses a malicious-software detection visualization method and system based on malicious network flow lexicons. The malicious-software detection visualization method includes the following steps that the content of HTTP network flow is subjected to word splitting, and the malicious network flow lexicons are established; a malicious software detection model is trained; the flow content of to-be-detected HTTP network flow is subjected to word splitting, and is split into word sets; the word sets are subjected to vectorization processing through the obtained lexicons; word vectors are input into a trained malicious-software detection model, and the trained malicious-software detection model gives the detection result through calculation; if the to-be-detected HTTP network flow is forecasted as malicious flow, a source app of the HTTP network flow of the malicious flow is found, and the source app is marked as a malicious app; the weights of words in malicious network flow are calculated; the flow content of the malicious network flow is visualized. The malicious-software detection visualization method and system based on the malicious network flow lexicons has the advantages that the transparent problem of users of the malicious flow detection process is fully solved.

Description

technical field [0001] The invention relates to a malicious software detection and visualization method and system based on a malicious network traffic lexicon. Background technique [0002] Today, Android malware is rampant, and malicious applications that cause various harms to users emerge in an endless stream. At present, the detection of malicious applications is mainly divided into three main directions. The first is based on static code scanning. It needs to maintain a malicious code library, because it compares all the codes of the application to be detected with the malicious code fragments in the malicious library, and once the comparison is successful, the application is considered as a malicious application. The second is an approach based on dynamic system calls. It goes deep into the interior of the Android application and observes the function calls of the application at runtime. The third is a detection method based on network traffic, which considers the...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to solve the above problems, to provide a malware detection visualization method and system based on the malicious network traffic lexicon, which fully solves the transparency problem of the malicious traffic detection process to the user

Images