Malicious software detection and classification model generation method and device

Abstract

An embodiment of the invention provides a malicious software detection method, a classification model generation method, a malicious software detection device and a classification model generation device. The malware detection method comprises the steps of: acquiring image data of unknown software, wherein the image data comprises at least one of a software icon of the unknown software and a feature image used for downloading a uniform resource locator (URL) of the unknown software; detecting the image data by using a classification model generated through deep learning in advance to obtain adetection value corresponding to the unknown software; and determining whether the unknown software is malicious software or non-malicious software according to the detection value. Therefore, the malicious software can be quickly and accurately detected.

Description

technical field [0001] The embodiments of the present invention relate to the field of Internet computer security protection, and in particular to a malware detection and classification model generation method and device. Background technique [0002] In recent years, with the rapid development of mobile Internet technology, especially the popularization of electronic devices such as smart phones, tablet computers, and computers, various types of software have emerged as the times require. For example, along with the popularization of Android mobile phones, APKs (Android Package, Android installation package) with various functions have emerged, that is, software installed on Android terminals. However, many criminals can use malicious software to conduct network attacks on users, such as stealing users' personal privacy information, downloading and executing malicious programs such as viruses, Trojan horses, and worms. Great harm. [0003] At present, malware is mainly de...

AI Technical Summary

Problems solved by technology

However, many criminals can use malicious software to conduct network attacks on users, such as stealing users' personal privacy information, downloading and executing malicious programs such as viruses, Trojan horses, and worms. great harm

[0003] At present, malware is mainly detected through the heuristics of character string signatures and artificial rules. However, this way of detecting malware relies heavily on the analyst's ability, requiring analysts to manually analyze existing software samples to find The corresponding features, the false detection rate is very high, and the detection efficiency is relatively low

Images