一种基于特征融合的恶意代码快速检测方法  

A Fast Malicious Code Detection Method Based on Feature Fusion

作　　者：王硕 王坚[1] 王亚男[1] 宋亚飞[1] WANG Shuo;WANG Jian;WANG Ya-nan;SONG Ya-fei(Air Defense and Antimissile School,Air Force Engineering University,Xi’an,Shaanxi 710051,China)

机构地区：[1]空军工程大学防空反导学院,陕西西安710051

出　　处：《电子学报》2023年第1期57-66,共10页Acta Electronica Sinica

基　　金：国家自然科学基金(No.61703426)。

摘　　要：随着恶意代码对抗技术的发展,恶意攻击者通过加壳、代码混淆等技术繁衍大量恶意代码变种,而传统恶意代码检测方法难以对其进行有效检测.基于恶意代码可视化的恶意代码检测方法被证明是一种能够有效识别恶意代码及其变种的新方法 .针对目前研究仅着眼于提升模型分类准确率而忽略了恶意代码检测的时效性,本文提出了一种基于特征融合的恶意代码快速检测方法 .该方法以深度神经网络为框架,采取模块化设计思想,将多尺度恶意代码特征融合与通道注意力机制结合,增强关键特征表达,并使用数据增强技术改善数据集类别不平衡问题.通过实验证明本文方法分类准确率高且参数量小、检测时效性高,优于目前的恶意代码检测技术.With the development of anti-malicious code technology, malicious attackers multiply a large number of malicious code variants by adding shell, code obfuscation and other technologies. However, traditional malicious code detection methods are difficult to detect them effectively. Malicious code detection based on malicious code visualization has been proved to be an effective method for identifying malicious code variants. The current research only focuses on improving the accuracy of model classification while ignoring the timeliness of malicious code detection. To solve the above problem, this paper proposes a fast malicious code detection method based on feature fusion. Based on the framework of deep neural network and the idea of modular design, our method combines multi-scale malicious code feature fusion with channel attention mechanism to enhance typical feature expression. In addition, data augmentation technology is utilized to deal with the problem of dataset category imbalance. The results of experiments indicate that the proposed method achieves high classification accuracy, small number of parameters and high detection timeliness, which is superior to the current malicious code detection technology.

关 键 词：恶意代码 深度神经网络 特征融合 通道注意力机制 数据增强技术 恶意代码可视化 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]