A Malicious Code Detection Method Based on Semantic Mapping Association

Abstract

The invention discloses a malicious code detection method based on semantic mapping association fusion, based on the semantic mapping relationship between dynamic and static API sequences of malicious code, the malicious code sample is converted into an API-based feature vector sample, based on the obtained malicious code Code sample feature vectors train machine learning classifiers to detect malicious code. The present invention converts the static and dynamic API sequences of the code into semantic block sequences divided by the behavior types by defining the code behavior type, realizes the association and fusion of the static and dynamic API sequences through the mapping between semantic blocks, and generates more abundant The feature vector space realizes a more systematic and comprehensive description of malicious codes, effectively improving the detection accuracy of malicious codes; by using the path length between semantic blocks as the weight of semantic blocks, it can accurately reflect the importance of the semantic path , thereby improving the accuracy of the eigenvector space.

Description

technical field [0001] The invention relates to the field of malicious code detection, in particular to a malicious code detection method based on semantic mapping association fusion. Background technique [0002] In the cyberspace environment, the security threats brought by malicious codes are increasing day by day, and the detection and protection of malicious codes is a focus of security research. Detecting whether a code is malicious based on behavioral characteristics is a commonly used malicious code detection method. In this regard, API call information can accurately reflect the behavior characteristics of the program, and can effectively resist anti-analysis methods such as malicious code obfuscation, so the method of detecting malicious code by extracting and analyzing API call sequences has been widely used. [0003] Summarizing the published research results, it can be found that the current analysis and detection methods based on API call sequences have the fo...

AI Technical Summary

Problems solved by technology

[0003] Summarizing the published research results, it can be found that the current analysis and detection methods based on API call sequences have the following deficiencies: (1) Researchers usually only extract the static or dynamic API sequences of the code, that is, only analyze and utilize the static or dynamic features of the code to develop detection, but did not combine the two effectively, resulting in insufficient space for the generated feature vectors, and the detection process is easily affected by malicious code obfuscation methods, which ultimately affects the detection accuracy; (2) Researchers analyze the static or dynamic features of the code separately To carry out detection, there is a lack of effective fusion of static features and dynamic features, so that researchers cannot effectively evaluate the impact of static features and dynamic features on the maliciousness of the analyzed code, which will eventually affect the researchers' judgment on the maliciousness of the code

Images