基于生成对抗网络的恶意样本识别模型  

Malicious Sample Identification Model based on Generative Adversary Network

作　　者：龚子超 邹福泰[1] GONG Zi-chao;ZOU Fu-tai(School of Cyberspace Security,Shanghai Jiaotong University,Shanghai 200240,China)

机构地区：[1]上海交通大学网络空间安全学院,上海200240

出　　处：《通信技术》2020年第6期1512-1516,共5页Communications Technology

摘　　要：随着互联网的高速发展,恶意软件增长速度极快,具体表现在其种类与数量上。主流的恶意代码分析大都基于复杂的特征工程与融合处理技术,存在着检测手段必须随时更新的缺点。近年来出现了各种基于将恶意样本转化为图像进而利用图像分类算法进行恶意样本检测的手段,但这种方法会因为加壳技术导致精确度下降。因此,借鉴生成对抗样本的思路,将加壳过程视为对抗样本的生成过程,设计了一套生成对抗样本网络用于提高图像判别的精度。模型在特定算法的加壳样本集上表现相较于无优化版本提升了接近10%,验证了该思路的可行性。With the rapid development of the Internet,the growth rate of malware is extremely fast,which is reflected in its type and quantity.Most of the mainstream malicious code analysis is based on complex feature engineering and fusion processing technology,which has the disadvantage that the detection means must be updated at any time.In recent years,various methods based on transforming malicious samples into images and using image classification algorithms to detect malicious samples have appeared,but this method would result in a decrease in accuracy due to the packing technology.Therefore,based on the idea of generating adversary samples,the packing process is regarded as the process of generating adversary samples,and a network of generative adversary sample is designed to improve the accuracy of image discrimination.The performance of the model on the packed sample set of a specific algorithm is improved by nearly 10%compared with the non-optimized version,which verifies the feasibility of this idea.

关 键 词：恶意样本 生成对抗网络 加壳样本识别 深度学习 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]