The invention discloses a malicious traffic detection method The method comprises the following steps: correspondingly establishing malicious and normal data sample libraries by using obtained malicious and normal data traffic samples; executing a data cleaning operation and a preprocessing operation on the data sample libraries in sequence to obtain training data, and constructing a traffic detection model by using the training data and a deep learning algorithm; judging whether to-be-measured data traffic contains malicious data by using the traffic detection model; and if so, sending alarminformation carrying the to-be-measured data traffic belonging to malicious data via a preset oath Feature learning and training are performed by using the malicious and normal data traffic samplesvia the automatic learning property of the deep learning algorithm, the feature information extraction operation is completed without consuming precious human resources, thereby improving the improving the work efficiency and improving the discrimination of the malicious traffic Precision The invention further discloses a malicious traffic detection system and apparatus and a computer readable storage medium, which have the above beneficial effects

Malicious traffic detection method, system and apparatus, and computer readable storage medium

The invention discloses a machine learning-based Android malicious program detection method. The method comprises the steps that feature extraction is conducted on black and white samples; a sample set is used for model training; to-be-detected samples are identified by a trained model; if the to-be-detected samples are identified as malicious samples, family classification is conducted on the samples, and if the to-be-detected samples are identified as white samples, abnormality detection is performed to determine whether or not the white samples are new malicious samples; a recognition result is fed back to a sample library for saving; a training set is added to a sample for identifying errors, and the model is retrained. According to the method, by adopting a machine learning algorithmand an online learning method, the problems of high missed detection rate and low identification accuracy of malicious programs in an existing detection method are solved.

Machine learning-based Android malicious program detection method

The invention relates to a ransomware defense method and system. The method comprises the following steps that 1, overall hooking is performed on an API which must be called by ransomware in the kernel mode or the user mode of an operation system; 2, finite segment cheating data is generated and deployed; 3, when a process is subjected to file traversal operation, a certain amount of cheating datais inserted into the traversal result and returned back to the process so as to cheat the process; 4, when the API obtained after overall hooking finds that the process operates the cheating data, whether the cheating data is abnormally changes or not is monitored so that whether the process is a malicious act of the ransomware or not is determined; 5, if the process is the malicious act of the ransomware, the process is ended and the user is informed. Under the condition of low consumption and zero loss, real-time detection and termination can be performed on the process of the ransomware, and users' and enterprises' data and property safety are protected.

Ransomware defense method and system

The invention discloses a machine learning-based remote evidence-taking tool security analysis system. The system is characterized by comprising a sandbox configuration and startup module, an API monitoring and matching module and a prediction and evaluation module. According to the machine learning-based remote evidence-taking tool security analysis system provided by the invention, behaviors of a to-be-detected remote evidence-taking tool in a sandbox are monitored by calling an API; through a corresponding matching algorithm, obtained API calling records are subjected to behavior classification; meanwhile, according to obtained characteristic behaviors, security prediction is performed by utilizing a machine learning model; security level evaluation is performed by utilizing an evaluation index calculation model; and finally a security analysis report is generated.

Machine learning-based remote evidence-taking tool security analysis system

The invention provides a method for establishing a browser fingerprint. The method comprises the following steps: obtaining a code fragment to form a code sequence; according to the code sequence, respectively obtaining execution result sets of different types of browsers for executing the code sequence; and utilizing execution result sets of the same type of browsers for executing the code sequence to obtain the browser fingerprint of the browser of the corresponding type for identifying the type of the browser. The invention also provides a method for identifying the browser type, which comprises the following steps: obtaining a code sequence used when the browser fingerprint is established; according to the code sequence, obtaining an execution result set of executing the code sequenceby a browser to be identified; and determining the type of the to-be-identified browser according to a pre-established browser fingerprint and the execution result set. The information contained in the established browser fingerprint can be enriched, and the possibility that the browser fingerprint is changed is reduced, so that the identification accuracy of the browser type is improved.

Method and device for establishing browser fingerprint and method and device for identifying browser type

The invention discloses a malicious program dynamic identification method based on a decision-making tree model. The method comprise the steps of 1, establishing a behavior collection sandbox module; 2, collecting black and white samples to form a training sample set; 3, capturing all behaviors generated when samples are operated; 4, calculating and combining feature identification nodes and behavior vectors of various behaviors of white samples to obtain a white vector set; 5, calculating and combining the feature identification nodes and the behavior vectors of the various behaviors of black samples to form a black vector set; 6, training the white vector set, the black vector set and a machine learning model to generate a decision-making tree; 7, capturing complete behaviors based on unknown sample programs according to a sandbox; 8, calculating behavior feature identification of the unknown samples; 9, calculating the behavior vectors of the samples and inputting the behavior vectors into the decision-making tree for identification; and 10, outputting sample identification results by the decision-making tree. Through adoption of the steps, a malicious program dynamic identification purpose is achieved through utilization of the decision-making tree model, and the problem that the efficiency is low and a process is complex in a malicious sample analysis process is solved.

Lyu Chengkun

Papers

Malicious program dynamic identification method based on decision-making tree model