Malicious software identification method and apparatus, and electronic device

Abstract

The invention provides a malicious software identification method and apparatus, and an electronic device. The method comprises the following steps: obtaining to-be-identified software and performingdecompilation on the to-be-identified software to obtain a to-be-processed code; splitting the to-be-processed code into multiple code gene fragments according to a location where a code for calling asystem API is located in the to-be-processed code; detecting the multiple code gene fragments by using a first random forest model to obtain a static detection result; running the to-be-identified software in a sandbox virtual environment to obtain the system API called by the to-be-identified software, detecting the system API called by the to-be-identified software by using a second random forest model, judging whether a malicious behavior exists in a dynamic operation process of the to-be-identified software, and obtaining a dynamic detection result; and judging whether the to-be-identified software is malicious software according to the static detection result and the dynamic detection result. Therefore, the identification accuracy of malicious software can be effectively improved, and malicious software can be more comprehensively identified.

Description

technical field [0001] The present application relates to the technical field of software security, and in particular, to a malware identification method, device and electronic equipment. Background technique [0002] With the continuous development of information technology, more and more software is applied to various electronic devices, and various software content providers are becoming more and more complicated. Correspondingly, the requirements for software security are also getting higher and higher. In the field of software security technology, it is often necessary to detect and identify unknown software to determine whether the software is malicious software. Most of the malware identification schemes in the prior art are based on static identification, that is, to analyze the software code as a whole, compare the software code with known malicious code, and judge whether there is malicious code in the software code. Singleness often leads to incomplete identifica...

AI Technical Summary

Problems solved by technology

Most of the malware identification schemes in the prior art are based on static identification, that is, to analyze the software code as a whole, compare the software code with known malicious code, and judge whether there is malicious code in the software code. Single, often resulting in incomplete identification and unstable detection results. For example, when processing packed samples, it will affect the results of static detection to a certain extent, resulting in misjudgment

Images