Ransomware variation detection method based on sequence alignment algorithm

Abstract

The invention provides a ransomware variation detection method based on a sequence alignment algorithm. The method comprises the specific steps of inputting a ransomware sample, extracting a sample feature sequence, processing the sample feature sequence into a gene sequence, and detecting a ransomware variation. The step of variation detection specifically comprises the sub-steps of clustering each gene sequence in a sample set, extracting clustering result information to acquire various ransomware families; using the sequence alignment algorithm Needleman-Wunsch to compute similarity betweena sample to be detected and a class cluster center sample of various ransomware families, screening out clusters with the similarity more than a preset threshold, and using the screened clusters to form a new ransomware training sample set; determining the ransomware family class to which the sample to be detected belongs b using the newly screened training sample set in combination with the sequence alignment algorithm and a KNN classification algorithm to achieve variation detection. According to the method, the purpose of quickly achieving ransomware variation detection is achieved by combining the sequence alignment algorithm with the existing classification algorithm.

Description

technical field [0001] The invention relates to a method for detecting ransomware variants based on a sequence comparison algorithm, and belongs to the technical field of software detection. Background technique [0002] At present, there are not many detection and defense methods for ransomware at home and abroad, which are mainly divided into the following categories: detection methods based on network traffic analysis, detection methods based on dynamic and static characteristics of ransomware, and detection methods based on decoy files. [0003] In the prior art, the invention patent application "a detection method and system for blackmailer virus", application number: CN201611094356.1, judges whether the encryption operation is performed by comparing the entropy value of the modified file and the backup file, and collects if there is an encryption operation All encrypted files, and determine whether the proportion of files with the same extension exceeds the preset valu...

AI Technical Summary

Problems solved by technology

[0004] The above mainstream detection methods do not focus on ransomware or ransomware variants, and most of them are general detection methods for multi-category malware, and are not optimized for ransomware

Images