| The proliferation of intelligent systems using advanced technology in recent years has given rise to a range of highly targeted malware such as ransomware,Trojans,viruses and malicious mining programs.To avoid detection,malware authors use various strategies for category disguise or family obfuscation in malware components,posing a significant security threat to enterprises,government agencies and network users.The threat posed by different types of malware poses a significant challenge to existing malware detection and classification methods.Depending on the detection technique,commonly used malware detection methods can be divided into traditional signature-based detection and machine learning-based detection.Traditional signature-based detection is fast and has a low false positive rate,but it relies on a large amount of existing expert experience and therefore can only detect known malware;machine learning-based detection has more advantages and can build detection models by extracting valid malware features,but different analysis methods have different applicability,advantages and disadvantages.Based on this,the commonly used malware family classification methods can be divided into image-based classification,binary-based classification and disassembly-based classification according to the different analysis principles.These methods each learn for different modalities of malware,which can improve the accuracy of malware family classification to a certain extent,but it is still difficult to eliminate the negative impact caused by inherent problems such as malware modification confusion and malware family evolution.To address the shortcomings of the above detection and classification methods,this paper proposes a new solution.The main research elements of this paper are as follows:(1)A framework for classifying malware families based on multimodal fusion is proposed.For malware and its disassembled files,focusing on multiple modalities such as bytes,format,statistics and semantics,multimodal feature fusion and feature selection are performed in the feature engineering phase to form a preliminary multimodal feature set of malware.Strategies such as weight self-learning and multimodal decision fusion are then applied in the model building phase to build a generic malware classification framework.(2)A malicious mining code detection method based on the malware classification framework is explored.Based on data exploration and feature analysis of malicious mining code,the multimodal malware feature set is updated to form a new malicious mining code feature set.The detection model is then constructed by using an improved malware classification framework to achieve malicious mining code detection.(3)A malware analysis system is designed and implemented,and the malware classification framework of this paper is applied to it.To address the limitation that traditional analysis tools cannot effectively identify unknown malware,a malware family classification framework based on multimodal fusion is incorporated into it,and an intelligent analysis module is added to make the malware analysis system intelligent.The system can detect and analyze samples uploaded by users and visualize the results of the sample analysis. |
