Training and detecting method and device of malicious code family

Abstract

The embodiment of the invention discloses a training and detecting method of a malicious code family. The method includes the steps that malicious codes are mapped into images, and image features of the images are extracted; the malicious code images are clustered according to the image features, and malicious code family labeling is conducted on different types of malicious code images obtained after clustering; a convolutional neural network model is established; the convolutional neural network model is trained with malicious code image sets obtained after malicious code family labeling, and the trained convolutional neural network model is used as a detection model; family detection is conducted on a malicious code sample to be detected and the variation of the malicious code sample with the detection model. The embodiment of the invention further discloses a training and detecting device of a malicious code family.

Description

technical field [0001] The embodiment of the present invention relates to the field of computer security technology and the field of deep learning, especially to a method and device for training and detecting malicious code families. Background technique [0002] As malicious codes become an important threat to information security, malicious code detection technology has become an important research direction in the field of information security. Malicious code detection methods mainly include signature-based detection methods and behavior-based detection methods. [0003] The detection method based on the characteristic code judges whether it is malicious code by detecting whether the file has a characteristic code of known malicious code (such as a special code or character string). Its advantages are fast, high accuracy, and low false positive rate, but it is difficult to detect malicious code variants and unknown malicious codes. Moreover, this method requires securit...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the above-mentioned technical problems, the embodiment of the present invention provides a method and device for training and detecting malicious code families, which can solve the problems of manual extraction of feature detection and large time overhead of behavior detection and high false positives. For malicious code variants And packing has excellent detection ability, with many characteristics such as fast detection speed, high accuracy rate, low false positive rate, and cross-platform detection

Images