基于卷积神经网络与多特征融合恶意代码分类方法  

Malware classification method based on convolutional neural network and multi-feature fusion

作　　者：郑珏 欧毓毅[1] Zheng Jue;Ou Yuyi(School of Computers,Guangdong University of Technology,Guangzhou 510006,China)

机构地区：[1]广东工业大学计算机学院,广州510006

出　　处：《计算机应用研究》2022年第1期240-244,共5页Application Research of Computers

基　　金：广州市科技计划资助项目(201902020007,202007010004)。

摘　　要：为了减小加壳、混淆技术对恶意代码分类的影响并提高准确率,提出一种基于卷积神经网络和多特征融合的恶意代码分类方法,以恶意代码灰度图像和带有API函数调用与操作码的混合序列为特征,设计基于卷积神经网络的多特征融合分类器。该分类器由图像组件、序列组件和融合组件构成,经训练后用于检测恶意代码类别。实验结果表明,相比目前已有的HYDRA、Orthrus等方法,该方法的分类准确率和宏F_(1)值更高,表明该方法能减小加壳、混淆技术影响,更准确地分类恶意代码。In order to reduce the impact of pack and obfuscation on malware classification and improve the accuracy,this paper proposed a malware classification method based on convolutional neural network and multi-feature fusion.The classifier was based on convolutional neural network and it took grayscale image of malware and the mixed sequence with API function call and opcode as features.The classifier had three components:image component,sequence component and fusion component.After training,the classifier could detect malware categories.The experimental results show that this method has higher classification accuracy and macro-F_(1) than some existing methods such as HYDRA and Orthrus.This method can classify malware more accurately and reduce the impact of packing and obfuscation.

关 键 词：恶意代码 静态分析 深度学习 多特征融合 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]