Using Object Detection Network for Malware Detection and Identification in Network Traffic Packets  

作　　者：Chunlai Du Shenghui Liu Lei Si Yanhui Guo Tong Jin 

机构地区：[1]School of Information Science and Technology,North China University of Technology,Beijing,100144,China [2]Department of Computer Science,University of Illinois Springfield,Springfield,USA

出　　处：《Computers, Materials & Continua》2020年第9期1785-1796,共12页计算机、材料和连续体（英文）

基　　金：This work was supported by Natural Science Foundation of China(61702013,61572492);the National Key research and Development Plan(Grant No.2018YFB0803504);Joint of Beijing Natural Science Foundation and Education Commission(KZ201810009011);Science and Technology Innovation Project of North China University of Technology(19XN108).

摘　　要：In recent years,the number of exposed vulnerabilities has grown rapidly and more and more attacks occurred to intrude on the target computers using these vulnerabilities such as different malware.Malware detection has attracted more attention and still faces severe challenges.As malware detection based traditional machine learning relies on exports’experience to design efficient features to distinguish different malware,it causes bottleneck on feature engineer and is also time-consuming to find efficient features.Due to its promising ability in automatically proposing and selecting significant features,deep learning has gradually become a research hotspot.In this paper,aiming to detect the malicious payload and identify their categories with high accuracy,we proposed a packet-based malicious payload detection and identification algorithm based on object detection deep learning network.A dataset of malicious payload on code execution vulnerability has been constructed under the Metasploit framework and used to evaluate the performance of the proposed malware detection and identification algorithm.The experimental results demonstrated that the proposed object detection network can efficiently find and identify malicious payloads with high accuracy.

关 键 词：Intrusion detection malicious payload deep learning object detection network 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]