Research on malicious code detection and classification based on dynamic and static features

Abstract

Malicious code can reflect its malicious behavior through dynamic API sequences and static PE header information, and deep learning algorithms have made progress in such malicious code detection. The article designs a 1D-CNN-BiGRU network model based on one-dimensional convolutional neural networks and bidirectional gated recurrent neural networks. The model takes API call sequences and PE header information as feature inputs and undergoes convolutional computation and recurrent neural network learning training to further learn the features of malicious code. Through the analysis of experimental results, the correctness of the malicious code verification of this model is demonstrated. The detection accuracy of normal samples on dynamic API call sequences is over 97%, and the accuracy on static PE structures is 95.64%. It has good performance in malicious code detection.