基于一维卷积神经网络的恶意代码家族多分类方法研究  

RESEARCH ON MULTI CLASSIFICATION METHOD OF MALICIOUS CODE FAMILY BASED ON ONE DIMENSION CONVOLUTIONAL NEURAL NETWORK

作　　者：王栋 杨珂 玄佳兴 韩雨桐 廖会敏 魏博垚 Wang Dong;Yang Ke;Xuan Jiaxing;Han Yutong;Liao Huimin;Wei Boyao(State Grid Electronic Commerce Co.,Ltd./State Grid Xiong’an Financial Technology Group Co.,Ltd.,Beijing 100053,China;Power Finance and E-commerce Laboratory,State Grid Corporation of China,Beijing 100053,China;Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China;College of Information Engineering,Capital Normal University,Beijing 100048,China)

机构地区：[1]国网电子商务有限公司(国网雄安金融科技集团有限公司),北京100053 [2]国家电网有限公司电力金融与电子商务实验室,北京100053 [3]中国科学院信息工程研究所,北京100093 [4]首都师范大学信息工程学院,北京100048

出　　处：《计算机应用与软件》2021年第12期332-336,340,共6页Computer Applications and Software

基　　金：国家重点研发计划项目(2018YFB0805005)。

摘　　要：为了提取有效的恶意代码特征,提高恶意代码家族多分类的准确率,提出一种改进模型。该模型将恶意代码的特征映射为灰度图,使用改进的恶意样本图像缩放算法进行图像的规范化处理,基于VGG模型构建一维卷积神经网络分类模型ID-CNN-IMIR。实验结果表明,恶意代码特征的提取和处理提升了分类效果;对比经典的机器学习算法、二维卷积神经网络、其他基于深度学习的恶意代码分类模型,ID-CNN-IMIR分类准确率是最好的,达到98.94%。In order to extract effective malicious code features and improve the accuracy of multi classification of malicious code family,an improved model is proposed.The features of malicious code were mapped to gray-scale image,and the image was normalized by applying an improved malware image rescaling(IMIR).A one-dimensional convolutional neural network classification model(1D-CNN-IMIR)was constructed based on VGG model.The experimental results show that the extraction and processing of the malicious code features improve the classification effect.Compared with the classical machine learning algorithm,two-dimensional convolutional neural network classification and other malicious code classification models based on deep learning,1D-CNN-IMIR has the best classification accuracy,reaching 98.94%.

关 键 词：深度学习 恶意代码 灰度图 卷积神经网络 恶意样本图像缩放 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]