Image matching-based malicious code detection method

Abstract

The invention discloses an image matching-based malicious code detection method. The method comprises the steps of S1, obtaining training samples corresponding to malicious codes of different family categories, converting the training samples into grayscale images and extracting corresponding image texture features; selecting a first reference sample from the training samples of each family category, selecting a second reference sample according to the first reference sample and the difference of the image texture features among the samples, and forming a corresponding reference sample set by the first reference sample and the second reference sample selected from each family category; S2, converting to-be-detected malicious codes into grayscale images and extracting corresponding image texture features; and S3, matching the image texture features extracted in the step S2 with the reference sample set corresponding to each family category, and confirming the family categories of the to-be-detected malicious codes according to matching results. The method has the advantages of simple realization, strong robustness, high detection accuracy and good detection effect.

Description

technical field [0001] The invention relates to the technical field of malicious code detection and analysis, in particular to a method for detecting malicious code based on image matching. Background technique [0002] With the widespread application of malicious code automatic generation tools and the application of open source code in malicious code, the number of malicious code variants and new malicious code families has also increased rapidly. According to statistics, the number of malicious code variants detected annually reached 430 million. Malicious code has become a major challenge to cyberspace security. Traditional malicious code detection methods are mainly divided into two types: one is the detection method based on the signature mechanism, which can quickly detect known malicious code samples, but the disadvantage is that it requires a lot of expert experience and manual analysis, and it is difficult to deal with deformation and obfuscated malicious code sam...

AI Technical Summary

Problems solved by technology

[0005] (1) Poor robustness and low detection accuracy

In this type of method, classification and detection are performed based on the features of the extracted malicious code. The detection accuracy obtained by different features may be different. The accuracy of feature extraction and the selection of features themselves will directly affect the accuracy of the final detection and analysis results. Therefore, the actual detection poor robustness and low detection accuracy;

[0006] (2) Low detection efficiency

This type of method is usually more complicated to implement, and usually takes a long time for model training, making the detection efficiency low

Images