Malicious code identification method and device, computer equipment and medium

Abstract

The invention relates to the technical field of artificial intelligence, and particularly discloses a malicious code identification method and device, computer equipment and a medium. The identification method comprises the following steps: analyzing a target code to obtain a characteristic value sequence used as target code identification information; respectively matching the characteristic value sequence with a plurality of pre-stored known value sequences; identifying that the target code is a malicious code based on the condition of successful matching, and calling and executing an adversarial script corresponding to a known value sequence matched with the feature value sequence; and performing classification processing on the target code based on the matching failure condition to determine the category to which the target code belongs so as to determine whether the target code is a malicious code. According to the invention, the malicious code can be accurately and quickly identified through dual modes of static detection and dynamic detection, the network security is greatly improved, and the possibility of honeypot escape of an attacker can be remarkably reduced.

Description

technical field [0001] The invention relates to the technical field of artificial intelligence, can be applied in the field of identification of malicious codes, and specifically provides identification methods, devices, computer equipment and media of malicious codes. Background technique [0002] With the continuous development of network security technology, network security personnel have developed honeypot detection technology. By arranging some hosts, network services, etc. as baits, the attacker is induced to attack these baits, and the attack behavior can be captured and analyzed, and then the tools and methods used by the attacker can be understood, and the intention and motivation of the attacker can be speculated; Let the defender clearly understand the security threats it faces, and achieve the purpose of using technical means to enhance its own security protection capabilities. The "honeypot" used to set up decoys serves as an intelligence collection system and...

AI Technical Summary

Problems solved by technology

[0003] However, due to the limitations of the existing technology, the identification of the target code is not accurate enough, and misjudgment often occurs.

Images