Malicious process detection method and device based on small sample learning, electronic equipment and storage medium

Abstract

The invention discloses a malicious process detection method and device based on small sample learning, electronic equipment and a storage medium, and the method comprises the steps: obtaining a serialized log reflecting a process behavior of a client as an original sample, and taking each process behavior type as a label added by the original sample; performing feature selection on each original sample to remove redundant features; performing serialization processing on each original sample subjected to feature selection to obtain a behavior feature vector of a corresponding process; performing small sample learning by utilizing the behavior feature vector of the non-malicious process behavior to obtain a prototype network, wherein the embedded function input of the prototype network is the behavior feature vector; and carrying out malicious behavior process detection on a to-be-detected sample by utilizing the behavior characteristics of the malicious process and the prototype network obtained by learning. According to the detection method, the detection rate is high under the condition that the existing malicious behavior samples are small in data size and unbalanced in distribution.

Description

technical field [0001] The present application relates to the technical field of information security, in particular to a malicious process detection method, device, electronic device and storage medium based on small sample learning. Background technique [0002] With the continuous development of Internet technology, the number of malicious programs on the network is also increasing rapidly. Remote access Trojan horse (RAT, remote access Trojan) is one of the malicious programs whose number continues to grow. Intruders can use RAT to Most of the malicious operations are carried out on the infected computer, such as monitoring user behavior, activating the system's camera and recording, disseminating viruses and other malicious software, accessing confidential information and passwords, etc., causing great harm. [0003] Currently, there have been some works to identify the behavior of RAT malicious programs. [0004] For RAT viruses, traditional detection methods are main...

AI Technical Summary

Problems solved by technology

However, in many practical applications, one may only be allowed access to very few training data for new categories, and within a limited range, only a very small number of samples for each new category

Images