基于多频特征学习的恶意代码变种分类  

Classification of malicious code variants based on multi-frequency feature learning

作　　者：靳黎忠[1] 薛慧琴 段明博 赵旭俊[2] 高改梅[2] JIN Li-zhong;XUE Hui-qin;DUAN Ming-bo;ZHAO Xu-jun;GAO Gai-mei(School of Applied Science,Taiyuan University of Science and Technology,Taiyuan 030024,China;College of Computer Science and Technology,Taiyuan University of Science and Technology,Taiyuan 030024,China)

机构地区：[1]太原科技大学应用科学学院,山西太原030024 [2]太原科技大学计算机科学与技术学院,山西太原030024

出　　处：《计算机工程与设计》2024年第7期1934-1940,共7页Computer Engineering and Design

基　　金：国防科技重点实验室基金项目(JSY6142219202114);太原科技大学科研启动基金项目(20212033)。

摘　　要：针对恶意代码变种分类方法没有充分对原始输入进行分析的问题,提出一种更加高效的基于深度学习的办法,使用卷积神经网络对多频信息进行学习。对恶意代码转化而成的图像进行研究,利用小波变换进行多频和多层次的分析,抓住低频和高频特征;针对多频信息输入,设计一种多频特征学习模块,充分挖掘其中有用信息。实验结果表明,该方法在Malimg数据集上,相比其它两种恶意代码分类办法,分别取得了1.5%和0.8%的效果提升。Aiming at the problems of the insufficient analysis of raw input in malicious code variant classification methods,a more efficient methodology of deep learning was presented.The convolutional neural networks(CNN)was used to learn multi frequency information.For the image transformed by malicious code,the wavelet transform was used to carry out multi-frequency and multi-level analysis,and the low frequency and high frequency characteristics were grasped.For the multi-frequency information input,a multi-frequency feature learning module was designed to fully explore the useful information.Experimental results show that compared with the other two malicious code classification methods,the proposed method achieves 1.5%and 0.8%improvement respectively on Malimg dataset.

关 键 词：恶意代码分类 多频特征 深度学习 小波变换 灰度图像 卷积神经网络 恶意代码家族 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]