基于深度学习的恶意代码检测综述  

Review of Malware Detection Based on Deep Learning

作　　者：宋亚飞[1] 张丹丹 王坚[1] 王亚男[1] 郭新鹏[1] SONG Yafei;ZHANG Dandan;WANG Jian;WANG Yanan;GUO Xinpeng(Air Defense and Antimissile School,Air Force Engineering University,Xi’an 710051,China)

机构地区：[1]空军工程大学防空反导学院,西安710051

出　　处：《空军工程大学学报》2024年第4期94-106,共13页Journal of Air Force Engineering University

基　　金：国家自然科学基金(61806219,61703426,61876189);陕西省科学基金(2021JM-226)。

摘　　要：恶意代码检测是网络空间安全领域的重要研究方向之一。在简要阐述恶意代码检测重大研究价值的基础上,结合国内外研究现状,总结了现有的基于深度学习的恶意代码检测技术及方法。首先,分别从静态、动态和混合检测方法多方面地梳理了传统检测技术,其次,分别从基于序列特征、图像可视化和数据增强的恶意代码特征提取方法出发,对基于深度学习的恶意代码分类识别方法进行了总结,最后,对基于深度学习的恶意代码特征提取与识别方向的技术难点和未来发展趋势进行了分析与展望。Rapid and accurate identification of unknown malware and its variants is one of the important research directions in the field of cyberspace security.Based on a brief description of the significant research value of malware detection,the existing deep learning-based malware detection techniques and methods are summarized in consideration of the current situation of domestic and foreign research.Firstly,the traditional detection techniques are sorted out from static,dynamic and hybrid detection methods respectively.Secondly,the malware classification and identification methods based on deep learning are summarized from the malware feature extraction methods based on sequence features,image visualization and data enhancement.Finally,the technical difficulties and future development trends of malware feature extraction and identification based on deep learning are analyzed and foreseen.

关 键 词：恶意代码 恶意代码分类 恶意代码检测 深度学习 网络空间安全 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]