A malicious code detection method based on semantic mapping association

Abstract

The invention discloses a malicious code detection method based on semantic mapping association fusion. Based on the semantic mapping between the dynamic and static API sequences of malicious code, malicious code samples are transformed into API-based feature vector samples, and the machine learning classifier is trained based on the feature vector of the obtained malicious code samples to realizethe detection of malicious code. As that type of code behavior is defined, a static and dynamic API sequence of code is converted to a semantic block sequence of behavior types, Through mapping between semantic blocks, the association and fusion of static and dynamic API sequences is realized, which generates more abundant feature vector space, realizes more systematic and comprehensive description of malicious code, and effectively improves the detection accuracy of meaning code. By taking the path length between semantic chunks as the weight of semantic chunks, we can accurately reflect theimportance of the semantic path and improve the accuracy of eigenvector space.

Description

technical field [0001] The invention relates to the field of malicious code detection, in particular to a method for detecting malicious code based on semantic mapping association. Background technique [0002] In the cyberspace environment, the security threats brought by malicious codes are increasing day by day, and the detection and protection of malicious codes is a focus of security research. Detecting whether a code is malicious based on behavioral characteristics is a commonly used malicious code detection method. In this regard, API call information can accurately reflect the behavior characteristics of the program, and can effectively resist anti-analysis methods such as malicious code obfuscation, so the method of detecting malicious code by extracting and analyzing API call sequences has been widely used. [0003] Summarizing the published research results, it can be found that the current analysis and detection methods based on API call sequences have the follo...

AI Technical Summary

Problems solved by technology

[0003] Summarizing the published research results, it can be found that the current analysis and detection methods based on API call sequences have the following deficiencies: (1) Researchers usually only extract the static or dynamic API sequences of the code, that is, only analyze and utilize the static or dynamic features of the code to develop detection, but did not combine the two effectively, resulting in insufficient space for the generated feature vectors, and the detection process is easily affected by malicious code obfuscation methods, which ultimately affects the detection accuracy; (2) Researchers analyze the static or dynamic features of the code separately To carry out detection, there is a lack of effective fusion of static features and dynamic features, so that researchers cannot effectively evaluate the impact of static features and dynamic features on the maliciousness of the analyzed code, which will eventually affect the researchers' judgment on the maliciousness of the code

Images