一种基于PE病毒转图和CNN的病毒识别方法

A Virus Recognition Method Based on PE Virus Transformation Map and CNN

随着互联网的爆炸式的发展,计算机病毒也是层出不穷,如何快速的对新增病毒进行响应和查杀也是一个较大的挑战[1]。普通的特征检测方法对于新样本的检测存在滞后性,往往无法有效查杀新增样本。通常的机器学习查杀病毒,则存在特征难以提取,训练集样本不均衡的问题。本文中提出一种方法,通过CNN算法和文件图像化表示算法结合进行病毒扫描的方法。本文中发现,通过CNN,可以有效的提取文件图像化后的特征,达到了自动提取特征的目的。修改了CNN中softmax算法,从而解决了样本不均衡问题。

With explosive development of the Internet,computer viruses are also emerging in an endless stream.How to respond and kill new viruses quickly is a big challenge.Common feature detection methods has hysteretic nature for detection of new samples,which often can not kill them effectively.Common machine virus detection and killing has problems of being difficult to extract features,unbalanced samples of training set.The article proposes a new virus detection method,which combines CNN algorithm with document visualization algorithm.Study shows that CNN can help to extract file’s features after image visualization effectively,and achieve purpose of automatic feature extraction.Softmax algorithm in CNN is modified to solve problem of sample imbalance.