Research on Malicious Code Detection Based on Feature Analysis

Malicious attackers often implant malicious software into the software used by victims. On the Internet, new malware continues to be shared, and its types and means of destruction vary. Upon the discovery of novel malware, one feasible strategy entails examining previous instances of comparable malware and attempting to employ existing malware countermeasures against the new threat. Nonetheless, managing the malicious nature and similarity across all software poses a significant challenge. Given the high efficiency of deep learning technology in detecting and classifying malicious software, this paper constructs a parallel branch deep learning model specifically for malicious code detection. This model takes API call sequences and PE (Portable Executor) header information as feature input items, and extracts features using a stacked prior attention network and BiGRU (Bidirectional Gated Recurrent Unit). After a thorough analysis of the experimental results, the effectiveness of the model in detecting malicious code was confirmed. When detecting normal samples, the detection accuracy of dynamic API call sequences can reach over 98%, while the detection accuracy of static PE structures can reach 97%. The experimental results fully demonstrate that this model has demonstrated good performance in malicious code detection work.