Method and device for detecting pe file abnormal behavior, medium and equipment

Abstract

The invention provides a method and a device for detecting pe file abnormal behavior, a medium and equipment. The method comprises the following steps: receiving a file to be detected; extracting thefeature data of the file to be detected; processing the feature data to obtain valid data; predicting whether the file to be detected is an abnormal file or not on the basis of a prediction model trained by a support vector machine ONECLASS model according to the valid data to obtain a prediction result; outputting the prediction result to a user. By adopting the prediction model trained by the support vector machine ONECLASS model, 0-day attacks can be recognized accurately. The method has the advantages of automation, timeliness, effectiveness and the like which are incomparable with the traditional method.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method, device, medium and equipment for detecting abnormal behaviors of PE files. Background technique [0002] With the rapid development of the Internet, network security issues have become increasingly prominent, and the continuous upgrading of virus technology has brought great challenges to the existing anti-virus technology. In the existing technology, rules or dynamic sandbox methods are mainly used to detect whether the pe file is abnormal. The traditional detection method has a lag. This detection method is not time-sensitive, cannot cope with the ever-changing hacker attacks, and cannot solve zero-day attacks. . Contents of the invention [0003] Aiming at the defects in the prior art, the present invention provides a method for detecting abnormal behavior of pe files, which can accurately identify 0-day attacks, and has good advantages such as automa...

AI Technical Summary

Problems solved by technology

In the existing technology, rules or dynamic sandbox methods are mainly used to detect whether the PE file is abnormal. The traditional detection method has a lag. This detection method is not time-sensitive, cannot cope with the ever-changing hacker attacks, and cannot solve zero-day attacks.

Images