Malware family classification method, system and medium based on rgb image and stacking multi-model fusion

Abstract

The invention discloses a malware family classification method, system and medium based on the fusion of RGB images and Stacking multi-models. The method includes: constructing an API category database Q; extracting malware API call sequence chains; constructing API calls according to the API call sequence chains relationship pair, get the directed graph G of the API call relationship pair; use the improved iterative scaling algorithm in the maximum entropy model to determine the weight, and obtain the weight w of each API call relationship pair i,j ;Obtain the RGB image representing the behavior of malware calling the API; Construct a stacking multi-model fusion classifier and conduct training and learning, input the RGB image data set representing each malware behavior feature into the classifier, so as to predict the name of the malware family . The present invention converts the API call behavior of malicious software into RGB images through conversion rules. The conversion process not only considers the number of API calls, but also considers the relationship between API calls, and uses Stacking technology for multi-model fusion, which can improve the accuracy of the model. Accuracy.

Description

technical field [0001] The invention belongs to the technical field of malware classification, and in particular relates to a malware family classification method, system and medium based on the fusion of RGB images and Stacking multi-models. Background technique [0002] Malware is an executable program written to serve some malicious purpose, including viruses, worms, and Trojan horses. Among them, ransomware has caused a serious impact on society. Ransomware mainly uses email phishing, account blasting, and loophole exploitation to attack enterprises, governments, education and other medium and large government and enterprise institutions, and make huge profits from it. At the same time, the number of malicious software is also increasing year by year. For example, in 2020, the number of malicious executable software known to the security community has exceeded 1.1 billion, and this number may continue to grow. There are three reasons for the increase in the number of ma...

AI Technical Summary

Problems solved by technology

Second, the abuse of automated malware generation tools has led to an increase in the number of malware variants

However, this method only considers the execution times of the malware during the entire execution process, and does not consider the correlation between the API and the API. In practice, the correlation between the APIs called by the malware and the API is very important for the classification results. has great influence

Images