| With the advent of the Internet era,it is also facing security issues.Malicious code has become the most important attack vector in network security incidents,causing serious losses to many companies and individuals.In recent years,in view of the explosive growth of malicious code,how to detect malicious code in an accurate and efficient manner has become a research hotspot in the field of information security.With the development of machine learning technology,the use of machine learning methods to achieve intelligent detection of malicious code has become a trend.This article is dedicated to applying machine learning methods to the field of malware detection.The main content of the thesis is composed of the following four aspects:(1)Aiming at most of the malware packing detection methods based on machine learning,the problem that attackers deliberately tampering with the attribute values of malicious sample files through the packing technology to cause the distortion of this part of the data is not considered.This article classifies it as a missing data classification problem and proposes~+-ELM packed malware detection algorithm for missing data.The algorithm is based on the theoretical basis of the A-ELM missing algorithm by introducing the kernel method to map the original malicious code data to a high-dimensional space,and realize the non-linear mapping of features.Experiments show that with the increase of the data missing rate,the~+-ELM algorithm can alleviate the impact of missing data information on the classification results to a certain extent,so it has a certain resistance to the distortion of some components of the feature vector of the packed malicious code.(2)Aiming at the inevitable loss of detection accuracy for a single type of data characterization,this paper proposes a multi-feature fusion malicious code detection scheme to further improve the accuracy of malicious code detection.According to the information characteristics of the PE file structure information and the API function call sequence,the program first constructs the corresponding neural network structure for training to obtain PE features and API features,and finally performs weighted summation at the feature level through the attention mechanism.These two characteristics are combined to express the malicious code sample information more comprehensively.(3)In the process of visualizing malicious code,large sample files need to be truncated,resulting in missing information and single characteristics.This paper proposes a visualization enhancement plan for malicious code.The program firstly extracts the key information of malicious sample files in a standardized way,and then adds behavioral information to make the final grayscale image contains richer sample information.After obtaining the grayscale image,This paper proposes a multi-feature malicious code image detection scheme that combines local features with global features.Compared with a single feature detection scheme,the multi-feature fusion image detection scheme achieves a higher accuracy rate because it more completely characterizes the image information.(4)Aiming at the problem that the distance function in the DBSCAN clustering algorithm fails in the high-dimensional data space,this paper proposes an unknown malicious code detection scheme based on shared neighbors.This scheme firstly constructs a malicious code similarity matrix by sharing the similarity of neighbors,and at the same time establishes a sample point relationship query table based on the similarity matrix,so that the DBSCAN algorithm uses the relationship query table to reduce the number of redundant queries when looking for boundary points. |
