基于卷积神经网络与多特征融合恶意代码分类方法

为了减小加壳、混淆技术对恶意代码分类的影响并提高准确率,提出一种基于卷积神经网络和多特征融合的恶意代码分类方法,以恶意代码灰度图像和带有API函数调用与操作码的混合序列为特征,设计基于卷积神经网络的多特征融合分类器。该分类器由图像组件、序列组件和融合组件构成,经训练后用于检测恶意代码类别。实验结果表明,相比目前已有的HYDRA、Orthrus等方法,该方法的分类准确率和宏F₁值更高,表明该方法能减小加壳、混淆技术影响,更准确地分类恶意代码。

Malware classification method based on convolutional neural network and multi-feature fusion

In order to reduce the impact of pack and obfuscation on malware classification and improve the accuracy, this paper proposed a malware classification method based on convolutional neural network and multi-feature fusion. The classifier was based on convolutional neural network and it took grayscale image of malware and the mixed sequence with API function call and opcode as features. The classifier had three components: image component, sequence component and fusion component. After training, the classifier could detect malware categories. The experimental results show that this method has higher classification accuracy and macro-F1 than some existing methods such as HYDRA and Orthrus. This method can classify malware more accurately and reduce the impact of packing and obfuscation.