基于深度学习的Linux远控木马检测  

Detection of Remote Access Trojan in Linux Based on Deep Learning

作　　者：李峰 舒斐 李明轩 王斌 杨慧婷 LI Feng;SHU Fei;LI Mingxuan;WANG Bin;YANG Huiting(Electric Power Science Research Institute,State Grid Xinjiang Electric Power Co. ,Ltd. ,Urumqi 830011,China)

机构地区：[1]国网新疆电力有限公司电力科学研究院,乌鲁木齐830011

出　　处：《计算机工程》2020年第7期159-164,共6页Computer Engineering

基　　金：国网新疆电力有限公司项目“电力行业工业控制系统安全监测与深度检测技术研究”(5230DK18000V)。

摘　　要：远控木马作为一种高级形态的恶意代码,不仅能收集用户敏感信息,而且可以通过命令控制引发大规模的攻击。为高效准确地识别远控木马,通过结合静态分析和动态行为分析方法提取文件特征,利用深度学习对样本特征逐层抽取的能力,构建基于循环神经网络(RNN)的样本分类模型,以对Linux远控木马进行检测。为避免陷入局部最优,采用随机搜索参数的方法进行模型超参数选择。对基于RNN的分类模型及其他基于传统机器学习算法的模型分别进行实验,结果表明,在选取性能最佳的超参数配置下,基于RNN的样本分类模型具有更高的准确率与F1值。As a high-level form of malicious code,Remote Access Trojan(RAT)can be used to collect sensitive user information and even launch large-scale attacks through command control.To accurately detect RAT,this paper proposes a new deep learning-based method that combines static analysis with dynamic behavior analysis to extract file features.By taking advantage of the ability of deep learning to extract sample features layer by layer,this method constructs a sample classification model based on Recurrent Neural Network(RNN)to detect RAT in Linux.Further,in order to avoid being trapped in local optima,random search of parameters is adopted to select hyperparameter of the model.Experimental results show that compared with other models based on traditional machine learning algorithms,the proposed RNN-based sample classification model has higher accuracy and F1 value when selecting the hyperparameter configuration with the best performance.

关 键 词：远控木马 静态分析 行为分析 循环神经网络 超参数 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]