Research And Implementation Of Malware Classification Based On Deep Learning

The classification of malware can quickly track the development of malware families and assess the overall situation of network security in order to defend against malware.When faced with a large amount of malware data,the traditional analysis methods will have problems such as complex marking process and slow time,which cannot meet the current requirements for the classification of a large amount of malware.Deep learning has a good effect in the field of image processing.It can automatically extract and classify image feature information.Based on this,this paper proposes to pre-process the malware data in Windows system into grayscale images and classify the malware by using the algorithm of convolution neural network fusion of attention mechanism.The main work of this thesis is as follows:(1)In the malware data preprocessing,firstly,it is known that the core instructions of malicious software exist in the code segments,so the characteristics of code segments are proposed to distinguish malicious software.Second,extract code segments and compress them.LZ77 compression method is adopted to ensure that the compressed features of the same family are still similar.Finally,the compressed code segment is transformed into gray image.After analyzing gray image,it is found that gray image of the same family type has similar characteristics,while gray image of different families has differences.Therefore,deep learning is used to classify gray image.(2)In the convolutional neural network fusion attention mechanism,a convolutional neural network model is first formed by multiple convolutional layers.The grayscale image of malware is taken as the input of the model,and features are extracted through the convolutional layer.In order to ensure the malware gray image edge detail texture can study,characteristic figure into the channel attention mechanism to obtain the eigenvalues of the need to pay attention to in the module,graph multiplication get new features and characteristics,and through a mechanism of spatial attention modules are need to focus on areas,combining channel characteristic figure and spatial characteristics of the figure.Finally,features that need to be paid attention are formed,so that new feature information can be learned with stronger robustness.Experiments show that the algorithm can improve the accuracy,improve the utilization rate of computer resources and save time.(3)A malware classification system is designed and implemented.Use the Django framework to build Web sites.Through the system test,the system function has reached the user demand,and the system has a high parallel access ability and has a fast response speed.