Malicious software detection system

Abstract

The invention provides a malicious software detection system, which comprises a metadata extraction module for receiving malicious software binary data as training data and extracting metadata; the data converter is used for extracting metadata from input malicious software binary data and converting the extracted metadata into image data, and the data converter comprises a first image generator, an audio file generator and a second image generator; the size adjusting module is used for adjusting the image data converted by the first image generator and the second image generator to a preset size suitable for training the neural network module; a data enhancement module that performs data enhancement on the image data converted by the first image generator and the second image generator; a neural network module receiving the image data enhanced by the data enhancement module to learn malware; and the visualization module is used for calculating the characteristics of the binary data of the malicious software extracted by the trained neural network module by using a t-SNE algorithm and visualizing two-dimensional and three-dimensional t-SNE graphs. According to the system, the result of the detection algorithm technology can be visually displayed and is convenient to read. The invention further provides a detection method of the malicious software detection system.

Description

technical field [0001] The present invention relates to a malware detection system, more specifically, it converts malware binary data into image data by applying image technology, and then applies image recognition based on deep learning to classify the image data. Background technique [0002] In recent years, with the increasing scale and diversity of mobile network malware, it has brought considerable threats to users' property and personal privacy. According to the research on the malicious behavior of various malware, the existing mobile malware detection methods are divided into three categories, which are static detection based on malicious code, dynamic detection based on system malicious call, and traffic detection based on network behavior. Static detection based on malicious code extracts static code features from the decompiled apk file and matches them with the feature library; dynamic detection based on malicious system calls runs applications and uses stains ...

AI Technical Summary

Problems solved by technology

However, machine learning-based malware detection techniques are still limited to drawing conclusions from correlations and patterns in accumulated data

Images