基于汇编指令词向量与卷积神经网络的恶意代码分类方法研究  

Malware Classification Method Based on Word Vector of Assembly Instruction and CNN

作　　者：乔延臣 姜青山[1] 古亮 吴晓明 QIAO Yanchen;JIANG Qingshan;GU Liang;WU Xiaoming(Shenzhen Institutes of Advanced Technology,Chinese Academy of Science,Shenzhen Guangdong 518000,China;Sangfor Technologies Inc,Shenzhen Guangdong 518000,China;Unit 31436 of PLA,Shenyang Liaoning 110001,China)

机构地区：[1]中国科学院深圳先进技术研究院 [2]深信服科技股份有限公司 [3]31436部队

出　　处：《信息网络安全》2019年第4期20-28,共9页Netinfo Security

基　　金：国家自然科学基金[U1401258]

摘　　要：针对目前恶意代码分类方法使用特征集过于依赖专家经验,以及特征维度较高导致的高复杂度问题,文章提出了一种基于汇编指令词向量与卷积神经网络(Convolutional Neural Network,CNN)的恶意代码分类方法。文章首先逆向恶意代码可执行文件获取汇编代码,将其中的汇编指令看作词,函数看作句子,从而将一个恶意代码转换为一个文档,然后对每个文档使用Word2Vec算法获取汇编指令的词向量,最后依据在训练样本集中统计的Top100汇编指令序列,将每个文档转换成一个矩阵。使用CNN在训练样本集上训练分类模型,结果表明该方法的平均准确率为98.56%。In view of the fact that the features used in the current malware classification method are too dependent on expert experience and high complexity problems caused by high feature dimensions,this paper proposes a classification based on word vector of assembly instruction and Convolutional Neural Network(CNN).This paper considers the assembly code file of the executable malware sample as a document,in which the assembly instruction is treated as a word,thereby converting a sample into a document,and using Word2 Vec method for each document to calculate the word vector of different instructions on the document.Each sample is then converted into a matrix based on the Top100 assembly instruction sequence counted in the training sample set.Finally,CNN is used to train the classification model on the training sample set.The experimental evaluations shows that the average accuracy of the method is 98.56%.

关 键 词：恶意代码 分类方法 Word2Vec CNN 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]