一种基于行为集成学习的恶意代码检测方法

为了解决变种恶意代码、未知威胁行为恶意分析等问题，研究了基于梯度提升树的恶意代码分类方法，从大量样本中学习程序行为特征和指令序列特征，实现了智能恶意代码分类功能.将GBDT算法引入恶意代码检测领域，使模型结果行为序列具有可解释性，对恶意代码的检测能力大幅提高.GBDT算法能够客观地反映恶意代码的行为和意图本质，能够准确识别恶意代码.

A Malicious Code Detection Method Based on Ensemble Learning of Behavior

In order to solve the problem of variant malicious code and behavior analysis of unknown threat, a method for malware classification based on gradient boosting decision tree (GBDT) algorithm is researched, which learns the characteristics of code behavior and instruction sequence from a large number of samples, and realizes the intelligent malicious code classification function. GBDT algorithm is introduced into the field of malicious code detection, so that the behavior sequence of the model is interpretable, and improves its ability to detect malicious code significantly. GBDT algorithm can reflect the nature of the behavior and intention of malicious code objectively, and identify malicious code accurately.