CN102142068A - Method for detecting unknown malicious code - Google Patents

Abstract

The invention discloses a method for detecting unknown malicious codes in the technical field of information security, which can detect malicious codes in files in advance without updating a malicious code library. The method includes using the Byte n-grams method to extract the feature vectors of the files in the training set; using a local linear embedding algorithm to reduce the dimensionality of the feature vectors of the extracted files in the training set; taking the feature vectors after dimensionality reduction as input, and using kernel coverage The learning algorithm trains the kernel coverage classifier; then uses the Byte n-grams method to extract the feature vectors of the files in the test set; uses the local linear embedding algorithm to reduce the dimensionality of the feature vectors of the extracted files in the test set; input the results after dimensionality reduction The core coverage classifier performs classification, makes statistics on the classification results and determines whether the files in the test set contain malicious code. The invention improves the detection speed of files and realizes the accurate detection of malicious codes in advance.

Description

A Detection Method of Unknown Malicious Code

technical field

The invention belongs to the technical field of information security, and in particular relates to a method for detecting unknown malicious codes.

Background technique

At present, malicious codes are ubiquitous on the Internet, and their dissemination, harm, and concealment are constantly improving, so that the detection of computer malicious codes is facing a huge challenge. There are two main types of existing computer malicious code detection technologies, one is the pattern matching technology based on signatures, and the other is the detection technology based on malicious code behavior rules.

The signature-based pattern matching technology is to manually analyze the malicious code file after it appears, extract the signature that can uniquely identify the malicious code file, and upgrade the signature to the malicious code signature database, and then The feature code library is provided to the user to detect and kill malicious codes in computer programs. The detection technology based on malicious code behavior rules detects malicious codes based on some malicious code behavior rules predefined by experts. The disadvantage of the above two detection methods is that the malicious code database must be constantly updated, otherwise new types of malicious code can bypass detection. In addition, these two technologies are post-event detection technologies, which cannot detect new malicious codes before they are executed. Only when malicious codes appear, the analysts will extract their features and update their signatures to the feature database. , can be detected. In the meantime, however, malicious code could have gotten executed and caused damage.

Contents of the invention

The purpose of the present invention is to propose a detection method for unknown malicious codes for the deficiencies in current malicious code detection technology, using a sample set containing both malicious files and non-malicious files as a training set, using a classification algorithm to train a classifier, and then Use the trained classifier to classify unknown files to determine whether they are malicious code files.

In order to realize the purpose of the present invention, the technical solution provided by the present invention is a detection method of unknown malicious code, which is characterized in that the method comprises the following steps:

Step 1: Utilize the Byte n-grams method to extract the feature vectors of the files in the training set;

Step 2: using a local linear embedding algorithm to reduce the dimensionality of the feature vectors of the files in the extracted training set;

Step 3: Take the feature vector after dimensionality reduction as input, and use the kernel coverage learning algorithm to train the kernel coverage classifier;

Step 4: Utilize the Byte n-grams method to extract the feature vector of the file in the test set;

Step 5: using a local linear embedding algorithm to reduce the dimensionality of the feature vectors of the files in the extracted test set;

Step 6: Input the result after dimensionality reduction into the kernel coverage classifier for classification, and after making statistics on the classification results, determine whether the files in the test set contain malicious code.

The use of the local linear embedding algorithm to reduce the dimensionality of the feature vector specifically includes:

Step 21: Using the feature vector as a sample point, use the K nearest neighbor method to find K neighbor points of each sample point, where K is a set value;

构造出每个样本点xi的局部重建权值矩阵，其中N为样本点的个数；Step 22: Utilize the formula

Construct a local reconstruction weight matrix for each sample point xi, where N is the number of sample points;

Step 23: Calculate its low-dimensional output value from the local reconstruction weight matrix of each sample point x _i and its neighbor points.

In the step 23, the low-dimensional output y _i of the sample point _xi satisfies the following mapping conditions:

且

其中I是m×m的单位矩阵，m是降维后的维数。

and

where I is the identity matrix of m×m, and m is the dimension after dimension reduction.

The step 3 specifically includes:

Step 31: In the sample space constituted by the sample points, construct the coverage field system;

Step 32: Fusing the coverage areas, merging the coverage areas belonging to the same category into a sphere of the feature space;

Step 33: Construct a fusion surface f(x), calculate the value of f( _xi ) for each sample point _xi , if the value of f(xi ₎ is greater than zero, then the sample point _xi represents no malicious code files; if the value of f( _xi ) is less than zero, then the sample point _xi represents a file containing malicious code.

The invention introduces a manifold learning algorithm to select the features of the file, can find meaningful low-dimensional structures from high-dimensional data and perform dimension reduction, and improves the detection speed of files; in addition, a kernel coverage learning algorithm is introduced into the classification learning algorithm , can construct a kernel function that can accurately divide the sample set at one time, so as to achieve the goal of accurately detecting emerging malicious codes.

Description of drawings

Fig. 1 is the schematic diagram of the process of the detection method of unknown malicious code;

Fig. 2 is a flow chart of dimensionality reduction of extracted feature vectors using local linear embedding algorithm;

Figure 3 is a flowchart of training a kernel-coverage classifier using the kernel-coverage learning algorithm.

Detailed ways

The preferred embodiments will be described in detail below in conjunction with the accompanying drawings. It should be emphasized that the following description is only exemplary and not intended to limit the scope of the invention and its application.

The idea of solving the problem of the present invention is: take files containing malicious codes and file sets not containing malicious codes as training samples, and use manifold learning algorithm to perform feature selection on the training set files, so that each file corresponds to a feature vector, and the features The vector is used as input to the kernel coverage classification algorithm to train the kernel coverage classifier. Finally, feature selection is performed on the unknown file to generate the corresponding feature vector, which is used as the input of the classifier to classify it, so as to distinguish whether it is a malicious file or a non-malicious file.

The specific implementation of the present invention will be described below in conjunction with the accompanying drawings. FIG. 1 is a schematic diagram of the detection process of the intelligent detection method for unknown malicious code provided by the present invention. The method comprises the steps of:

Step 1: Use the Byte n-grams method to extract the feature vectors of the files in the training set.

The training set can be constructed from the standard data set downloaded from the Internet. On the Internet, you can download a standard data set specially used for malicious code detection. The data set will contain malicious code files and normal files. You can select files from the standard data set according to specific rules to construct a training set.

The Byte n-grams method uses a sliding window of n bytes to extract words from the binary byte stream or text, and each word is n bytes in size. For example, the content of a text file is "abcdef", then its 2-grams sequence is: ab bc cd de ef, and the 3-grams sequence is: abc bcd cde def.

Taking the content of a file as "abcd" as an example, the sequence of 2-grams extracted from the file is: ab bccd. In this way, the file has three attributes, and the vector composed of these three attributes can be used to represent the file. The vector is: {ab, bc, cd}.

By quantifying each attribute, the feature vector of the file can be obtained. For example, the position of a in the alphabet is 1, and the position of b is 2..., then we can quantify according to the rule of position sum, and the quantized result is {3, 5, 7}. The vector {3, 5, 7} is the feature vector of the file.

Step 2: Using a local linear embedding algorithm to reduce the dimensionality of the extracted feature vectors of the files in the training set. Fig. 2 is a flow chart of dimensionality reduction of extracted feature vectors using local linear embedding algorithm. In Fig. 2, dimensionality reduction of feature vectors of files in the extracted training set using local linear embedding algorithm includes:

Step 21: Using the feature vector as a sample point, use the K nearest neighbor method to find K neighbor points of each sample point, where K is a set value.

The K sample points closest to the sample point to be obtained are specified as the K neighbor points of the sample point to be obtained, where K is a predetermined value, and the distance can be calculated using the Euclidean distance calculation method. The Euclidean distance algorithm is as follows: Let x, y∈R ^N , then the Euclidean distance of x, y can be obtained by the following formula:

${<span\; class="notranslate">\; (</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; N</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}^{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; the\; y</span>}}^{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; )</span>}^{\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; 2</span>}}}$

构造出每个样本点x_i的局部重建权值矩阵

其中

N为样本点的个数。Step 22: Utilize the formula

Construct a local reconstruction weight matrix for each sample point x _i

in

N is the number of sample points.

W=(w _ij )∈M _{n, n} is such a weight matrix, if x _i and x _j are not adjacent, then w _ij =0, set x _i and x _j (j=1,2,...,K ) are adjacent, then there is a constraint

Using XW to represent X approximately, there will be certain errors. Here, the Frobenius norm of the matrix is defined as follows: A=(a _{i, j} )∈M _{m, m} , which is an m-order matrix, then

即

这相当于求一系列最小二乘问题的解。如对x_i而言，由下面的方程组可以获得Find W by the following constraints:

Right now

This is equivalent to finding the solution to a series of least squares problems. As for x _i , the following equations can be obtained

${\mathrm{<span\; class="notranslate">\; w</span>}}_{\mathrm{<span\; class="notranslate">\; jk</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; :</span>\left\{\begin{array}{c}\underset{\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; K</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; w</span>}}_{\mathrm{<span\; class="notranslate">\; jk</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; x</span>}{\mathrm{<span\; class="notranslate">\; w</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}\end{array}\right.$

Step 23: Calculate its low-dimensional output value from the local reconstruction weight matrix of each sample point x _i and its neighbor points.

其中y_i是x_i的输出向量，y_jk，i(k＝1，2，…，K)是y_i的近邻点，并且要满足两个条件：

与

其中I是m×m的单位矩阵。由此，损失函数可重写为：其中M是n×n的对称矩阵：M＝(I-W)^T(I-W)。Through the weight matrix W, we can find the appropriate y _i in the low-dimensional space, which can be done by the following constraints:

Where y _i is the output vector of x _i , y _{jk, i} (k=1, 2, ..., K) is the neighbor point of y _i , and two conditions must be met:

and

where I is the identity matrix of m×m. Thus, the loss function can be rewritten as: where M is an n×n symmetric matrix: M=(IW) ^T (IW).

To minimize the value of the loss function, Y is the eigenvector corresponding to the smallest m non-zero eigenvalues of M. During the processing, the eigenvalues of M are arranged from small to large, and the first eigenvalue is almost close to zero, then the first eigenvalue is discarded. Usually, the eigenvectors corresponding to the eigenvalues from the 2nd to the m+1th are taken as the output result.

Step 3: Taking the dimensionally reduced feature vector as input, train a kernel-coverage classifier using the kernel-coverage learning algorithm.

Kernel coverage learning algorithm introduces the kernel function into the coverage algorithm. First, take a kernel function K(x, y)=<T(x), T(y)> and do the following transformation T: D→Z, x∈D; where D is the domain of the input is n-dimensional space Bounded set, a total of p samples, this transformation is to map the points on D to the P-dimensional kernel space. The input set of the kernel space is P _t , t=1, 2, . . . , p. In the kernel space, it is advisable to assume that the first k values of the output set Y are all different. Let the set of all sample labels whose output is Y _j (j≤k) be I _j , and its corresponding input set be denoted as P _j (j=0, 1, . . . , k-1). After a series of initializations above, the coverage in a batch of kernel spaces can be obtained. Fig. 3 is the flow chart that utilizes kernel coverage learning algorithm to train nuclear coverage classifier, among Fig. 3, utilizes kernel coverage learning algorithm to train kernel coverage classifier and comprises the following steps:

Step 31: In the sample space constituted by the sample points, construct the coverage field system.

(1) Randomly select a point x _j ∈ P _t that has not been covered in the sample set, according to the formula

${\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&NotElement;</span>{\mathrm{<span\; class="notranslate">\; I</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{\mathrm{<span\; class="notranslate">\; min</span>}}<span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; K</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; m</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \}</span>$

${\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; I</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{\mathrm{<span\; class="notranslate">\; max</span>}}<span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; K</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; m</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; K</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; m</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; <</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; \}</span>$

${\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; [</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; /</span>\mathrm{<span\; class="notranslate">\; 2</span>}$

${\mathrm{<span\; class="notranslate">\; \&theta;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; [</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; ]</span><span\; class="notranslate">\; /</span>\mathrm{<span\; class="notranslate">\; 2</span>}$

该覆盖的中心为x_i，覆盖半径为d_j，分类间隔为d_j。其中，I_j是一个下标的集合，x_m表示一个样本点，在第一个公式中，x_m表示m的值不属于I_j。Compute, construct a cover from _xi and _dj

The center of the coverage is x _i , the coverage radius is d _j , and the class interval is d _j . Among them, I _j is a set of subscripts, x _m represents a sample point, and in the first formula, x _m represents that the value of m does not belong to I _j .

求出后，将P_t中所有的已被

覆盖的点从P_t中删除，再从P_t中选择一个x_j(j∈I_j)，重复第(1)步操作，直到所有的x_j∈I_j均被删除为止。这样便构造出一个类的所有覆盖领域。(2)

After finding out, all the items in P _t have been

The covered points are deleted from P _t , and then a x _j (j∈I _j ) is selected from P _t , and step (1) is repeated until all x _j ∈ I _j are deleted. This constructs all coverage fields of a class.

Step 32: Fusing the coverage domains, merging the coverage domains belonging to the same category into a sphere of the feature space.

其中d_i表示以x_i为中心的领域的半径，求二次规划问题：For all coverage areas obtained, let

Where d _i represents the radius of the domain centered on _xi , and the quadratic programming problem is found:

$\left\{\begin{array}{c}\mathrm{<span\; class="notranslate">\; max</span>}\mathrm{<span\; class="notranslate">\; w</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; m</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; 2</span>}}\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; m</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; K</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; K</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; /</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>\\ \underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; m</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1,2</span>}<span\; class="notranslate">\; ,</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span>\mathrm{<span\; class="notranslate">\; m</span>}\end{array}\right.$

The optimal solution α ^* = {α ₁ α ₂ . . . α _m } is obtained.

Step 33: Construct a fusion surface f(x), calculate the value of f( _xi ) for each sample point _xi , if the value of f( _xi ) is greater than zero, then the sample point _xi does not contain malicious files; If the value of f( _xi ) is less than zero, then the sample point _xi contains malicious files.

Construct a hyperplane with α ^* obtained in step 32:

$\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; m</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}\mathrm{<span\; class="notranslate">\; K</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span>$

Its discriminant function is: F(x)=Sign(f(x)+b ₀ ), where b ₀ is the decision threshold.

When classifying samples, calculate the value of f(x) for each sample, if f(x)>0, then x belongs to the positive class (that is, no malicious files), if f(x)<0, then x Belongs to the negative class (that is, contains malicious files), if f(x)=0, it is said that x is rejected. A threshold ε can be set, and when |f(x)|<ε, it is considered that x is rejected, which can reduce errors.

Step 4: Use the Byte n-grams method to extract the feature vectors of the files in the test set.

As in step 1, use the Byte n-grams method to extract the feature vectors of the files in the test set. The test set can be selected from datasets available on the web.

Step 5: Using a local linear embedding algorithm to reduce the dimensionality of the extracted feature vectors of the files in the test set.

As in step 1, the feature vector extracted in step 4 is reduced in dimension using a local linear embedding algorithm.

Step 6: Input the result after dimensionality reduction into the kernel coverage classifier for classification, and after making statistics on the classification results, determine whether the files in the test set contain malicious files.

Take the dimension reduction result of step 5 as input, use the kernel coverage classifier obtained in step 3 to classify the dimension reduction result of step 5, and make statistics on the classification results, and then determine the files in the test set according to the classification statistics results of the kernel coverage classifier Whether it contains malicious files.

The invention uses a sample set containing both malicious files and non-malicious files as a training set, uses a classification algorithm to train a classifier, and then uses the trained classifier to classify unknown files to determine whether they are malicious files. In the process of file feature selection, manifold learning algorithm is introduced to analyze and process a large number of file feature attributes to find meaningful low-dimensional structures hidden in high-dimensional data, so as to achieve the reduction of high-dimensional file feature attributes. The purpose of dimension processing improves the processing speed. The kernel coverage learning algorithm is introduced into the classification learning algorithm. This algorithm introduces the concept of the kernel function in the support vector machine into the coverage algorithm. Compared with the support vector machine algorithm, this algorithm can construct a model for any given sample set. The kernel function of the sample set can be accurately divided once, thus ensuring that the system still has a good classification accuracy and a small amount of calculation in the case of insufficient prior knowledge and small samples.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (3)

1. a detection method of unknown malicious code, it is characterized in that described method comprises the following steps: Step 1: Utilize the Byte n-grams method to extract the feature vectors of the files in the training set; Step 2: using a local linear embedding algorithm to reduce the dimensionality of the feature vectors of the files in the extracted training set; Step 3: Take the feature vector after dimensionality reduction as input, and use the kernel coverage learning algorithm to train the kernel coverage classifier; Step 4: Utilize the Byte n-grams method to extract the feature vector of the file in the test set; Step 5: using a local linear embedding algorithm to reduce the dimensionality of the feature vectors of the files in the extracted test set; Step 6: Input the result after dimensionality reduction into the kernel coverage classifier for classification, and after making statistics on the classification results, determine whether the files in the test set contain malicious code. 2. the detection method of a kind of unknown malicious code according to claim 1, it is characterized in that described adopting local linear embedding algorithm to carry out dimensionality reduction to feature vector and specifically comprise: Step 21: Using the feature vector as a sample point, use the K nearest neighbor method to find K neighbor points of each sample point, where K is a set value; Step 22: Utilize the formula

Construct a local reconstruction weight matrix for each sample point x _i , where

N is the number of sample points; Step 23: Calculate its low-dimensional output value from the local reconstruction weight matrix of each sample point x _i and its neighbor points. In the step 23, the low-dimensional output y _i of the sample point _xi satisfies the following mapping conditions: and

where I is the identity matrix of m×m, and m is the dimension after dimension reduction. 3. the detection method of a kind of unknown malicious code according to claim 1, it is characterized in that described step 3 specifically comprises: Step 31: In the sample space constituted by the sample points, construct the coverage field system; Step 32: Fusing the coverage areas, merging the coverage areas belonging to the same category into a sphere of the feature space; Step 33: Construct a fusion surface f(x), calculate the value of f( _xi ) for each sample point _xi , if the value of f(xi ₎ is greater than zero, then the sample point _xi represents no malicious code files; if the value of f( _xi ) is less than zero, then the sample point _xi represents a file containing malicious code.

Images