CN107092829A - A kind of malicious code detecting method based on images match - Google Patents

Abstract

The invention discloses a malicious code detection method based on image matching. The steps include: S1. Obtain training samples of malicious codes corresponding to different family categories, respectively convert the training samples into grayscale images and extract corresponding image texture features; from each family The first benchmark sample is selected from the training samples of the category, and the second benchmark sample is selected according to the difference of the image texture characteristics between the first benchmark sample and the samples, and the first benchmark sample and the second benchmark sample selected by each family category form a corresponding Benchmark sample set; S2. Convert the malicious code to be detected into a grayscale image, and extract the corresponding image texture features; S3. Match the image texture features extracted in step S2 with the benchmark sample sets corresponding to each family category , confirm the family category of the malicious code to be detected according to the matching result. The invention has the advantages of simple implementation method, strong robustness, high detection accuracy and high detection effect.

Description

A Malicious Code Detection Method Based on Image Matching

technical field

The invention relates to the technical field of malicious code detection and analysis, in particular to a method for detecting malicious code based on image matching.

Background technique

With the widespread application of malicious code automatic generation tools and the application of open source code in malicious code, the number of malicious code variants and new malicious code families has also increased rapidly. According to statistics, the number of malicious code variants detected annually reached 430 million. Malicious code has become a major challenge to cyberspace security. Traditional malicious code detection methods are mainly divided into two types: one is the detection method based on the signature mechanism, which can quickly detect known malicious code samples, but the disadvantage is that it requires a lot of expert experience and manual analysis, and it is difficult to deal with deformation and obfuscated malicious code samples; the other is a detection method based on abnormal behavior, which can detect zero-day vulnerabilities and new types of malicious code samples, but its false positive rate is also high.

Malicious code detection methods based on automated analysis can solve the above problems. This type of method mainly uses machine learning methods to analyze malicious codes. It is usually divided into three steps: ① extracting malicious code features; ② selecting an appropriate model; ③ obtaining classification results. Malicious code detection methods based on automated analysis in the prior art can be divided into two types from the perspective of feature selection: one is based on static features, and the other is based on dynamic features. The first type of method There is no need to run malicious code, only the binary code or operation code of the malicious code needs to be obtained through tools such as IDA, PEView, and hap-depends, etc., such as using bytecode N-Gram as the detection feature of malicious code, and then reducing the Feature dimension, and finally classify malicious code through SVM model, or use the characteristics of the combination of OpCode and bytecode, and then use the integrated learning method to classify samples; compared with static learning, dynamic learning can accurately obtain malicious code behavior information and Purpose, the second method based on dynamic features needs to run the program to obtain the dynamic behavior of the program, and finally the features extracted by the feature extraction method are static features and dynamic features, such as API-based call strings and parameter information extraction malicious The behavioral knowledge of the code and convert this knowledge into feature vectors.

The above-mentioned malicious code detection method based on automated analysis has the following defects:

(1) Poor robustness and low detection accuracy. In this type of method, classification and detection are performed based on the features of the extracted malicious code. The detection accuracy obtained by different features may be different. The accuracy of feature extraction and the selection of features themselves will directly affect the accuracy of the final detection and analysis results. Therefore, the actual detection poor robustness and low detection accuracy;

(2) The detection efficiency is low. This type of method is usually more complicated to implement, and usually requires a long time for model training, making the detection efficiency low.

Contents of the invention

The technical problem to be solved by the present invention lies in: aiming at the technical problems existing in the prior art, the present invention provides a malicious code detection method based on image matching with simple implementation method, strong robustness, high detection accuracy and detection effect.

In order to solve the problems of the technologies described above, the technical solution proposed by the present invention is:

A malicious code detection method based on image matching, the steps comprising:

S1. Reference sample selection: obtain training samples corresponding to different family categories of malicious code, respectively convert the training samples into grayscale images and extract corresponding image texture features; select the first reference sample from the training samples of each family category, And selecting a second reference sample according to the difference in image texture features between the first reference sample and the samples, and forming a corresponding reference sample set from the first reference sample and the second reference sample selected for each family category;

S2. Image feature extraction: convert the malicious code to be detected into a grayscale image, and extract the corresponding image texture features;

S3. Test code classification: Match the image texture features extracted in the step S2 with the reference sample sets corresponding to each family category, and confirm the family category of the malicious code to be detected according to the matching result.

As a further improvement of the present invention, the specific steps for selecting the second benchmark sample for each family category in the step S1 are:

S11. Acquisition of candidate reference samples: matching each of the selected first reference samples with the remaining training samples, and finding out the wrongly assigned training samples in each family category according to the matching results and using them as candidate reference samples;

S12. Determination of the second benchmark sample: calculate the difference value between each candidate benchmark sample and other candidate benchmark samples in each family category, and if the calculated difference value is greater than the specified threshold, the corresponding candidate benchmark sample as the second benchmark sample for the corresponding family category.

As a further improvement of the present invention, in the step S12, specifically by calculating the Gabor function value of each of the candidate reference samples, and the distance value between each of the candidate reference samples and other training samples, according to the Gabor function value, The distance value computes a difference value between the candidate reference sample and other candidate reference samples.

As a further improvement of the present invention, the difference between a candidate reference sample and other candidate reference samples is specifically calculated by the following formula;

p _d (es _id )=∑ _j=0,1,...,N D(es _id ,es _hj )

Among them, es _id is the dth candidate benchmark sample of class i, es _hj is the jth candidate benchmark sample of class h, D(es _id ,es _hj ) is the distance between sample es _id and sample es _hj , h is the family category whose es _id is misassigned, μ is the trade-off coefficient, N is the number of benchmark samples contained in the family category h, M is the number of benchmark samples, and l is the vector length of the image texture feature.

As a further improvement of the present invention: the image texture feature is a signal-type static texture feature.

As a further improvement of the present invention: the image texture feature is specifically extracted by using a Gabor filter.

As a further improvement of the present invention, the specific steps for confirming the family category of the malicious code to be detected in the step S3 are:

S31. Respectively obtain the matching results of the malicious code to be detected and all the benchmark samples in the benchmark sample set of each family category;

S32. Obtain a comprehensive matching value corresponding to each family category from all matching results of each family category, and judge whether the malicious code to be detected belongs to the corresponding family category according to the comprehensive matching value of each family category.

As a further improvement of the present invention: the comprehensive matching value is specifically calculated according to the following formula;

in, es _test is the malicious code to be detected, es _ij is the jth benchmark sample of the i-th category, and N is the number of benchmark samples contained in the family category i.

As a further improvement of the present invention: when the comprehensive matching value R corresponding to the target family category satisfies R>0, it is determined that the malicious code to be detected belongs to the target family category; otherwise, it is determined that the malicious code to be detected does not belong to the target family category.

Compared with the prior art, the present invention has the advantages of:

1) The malicious code detection method based on image matching of the present invention automatically extracts image texture features, performs image matching based on feature similarity analysis, and then realizes family classification and judgment based on image matching results, which can realize automatic detection, which can be realized conveniently and efficiently Large-scale malicious code family detection and analysis;

2) The malicious code detection method based on image matching of the present invention, in the image matching process, by first selecting the first reference sample of each family category, and then selecting the second reference sample according to the first reference sample and the image texture feature difference between the samples Samples, the first benchmark sample and the second benchmark sample constitute the benchmark sample set for image matching of the malicious code to be detected, and finally confirm the family category of the malicious code to be detected, without the need for long-term model training, the selected benchmark samples are highly reliable , which can greatly reduce the impact of the selection of reference samples on the detection results, thereby improving the detection accuracy;

3) The malicious code detection method based on image matching of the present invention further selects the first reference sample first, and then selects the second reference sample based on the first reference sample, and finds the wrongly matched sample as a candidate through the matching state with the first reference sample Baseline sample, the difference value between the candidate benchmark sample and the training sample of the current family category is calculated, and finally based on the difference value, it is determined whether to use it as a new benchmark sample, so that the sample assigned by the error and has a large difference from other samples is also As a benchmark sample, the implementation method is simple. Compared with the traditional image matching, directly selecting the benchmark sample can effectively increase the reliability of benchmark sample selection, thereby further improving the accuracy of malicious code detection.

Description of drawings

FIG. 1 is a schematic diagram of the implementation flow of the malicious code detection method based on image matching in this embodiment.

FIG. 2 is a schematic diagram of the implementation principle of the malicious code detection method based on image matching in this embodiment.

FIG. 3 is a schematic diagram of a specific implementation process of grayscale image conversion in this embodiment.

Fig. 4 is a grayscale image obtained in a specific embodiment of the present invention.

detailed description

The present invention will be further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the protection scope of the present invention is not limited thereby.

As shown in Figures 1 and 2, the malicious code detection method based on image matching in this embodiment, the steps include:

S1. Benchmark sample selection: Obtain training samples corresponding to different family categories of malicious code, respectively convert the training samples into grayscale images and extract corresponding image texture features; select the first benchmark sample from the training samples of each family category, and according to Selecting a second benchmark sample based on the differences in image texture features between the first benchmark sample and the samples, and forming a corresponding benchmark sample set from the first benchmark sample and the second benchmark sample selected for each family category;

S2. Image feature extraction: convert the malicious code to be detected into a grayscale image, and extract the corresponding image texture features;

S3. Test code classification: match the image texture features extracted in step S2 with the benchmark sample sets corresponding to each family category, and confirm the family category of the malicious code to be detected according to the matching results.

The texture of the image can reflect the visual characteristics of homogeneous phenomena in the image, and at the same time, it can reflect the slowly changing or periodically changing surface structure organization and arrangement properties of the object surface. In this embodiment, the detection of malicious codes is realized based on image matching by using the above-mentioned characteristic texture characteristics, by automatically extracting image texture features, performing image matching based on feature similarity analysis, and then realizing family classification and judgment based on image matching results, which can realize detection. It is automated and can be easily applied to PCs, mobile clients, etc., or in the back-end classification system of large-scale malicious code family homology analysis for malware detection, and can efficiently collect samples from a large number of samples to be detected through online or offline methods mining malicious code.

In the image matching process of this embodiment, by first selecting the first reference sample of each family category, and then selecting the second reference sample according to the first reference sample and the difference in image texture characteristics between the samples, the first reference sample, the second The benchmark sample constitutes the benchmark sample set for image matching of the malicious code to be detected, and finally confirms the family category of the malicious code to be detected, without the need for long-term model training, the detection efficiency is high, and the selected benchmark samples are highly reliable, which can greatly reduce the The impact of sample selection on the detection results, thereby improving the detection accuracy.

In this embodiment, the specific steps for selecting the second reference sample for each family category in step S1 are:

S11. Acquisition of candidate reference samples: matching the selected first reference samples with the remaining training samples, and finding out the wrongly assigned training samples in each family category according to the matching results and using them as candidate reference samples;

S12. Determination of the second benchmark sample: Calculate the difference between each candidate benchmark sample and other candidate benchmark samples in each family category, and if the calculated difference value is greater than the specified threshold, then use the corresponding candidate benchmark sample as the corresponding family category The second benchmark sample of .

In the traditional image matching, a reference sample is directly selected from the sample set of known category as the reference sample of this category. If the image of the sample to be detected matches the image of the reference sample, the sample to be detected is judged to be the corresponding image of the reference sample. In the category, the matching effect obtained by selecting the reference image of different samples may be different, and the selection of the reference sample will directly affect the accuracy of the matching effect. When selecting a reference sample in this embodiment, the second reference sample is selected based on the first reference sample. During the selection process of the second reference sample, firstly, the sample with a matching error is found through the matching state with the first reference sample as a candidate reference sample, and then Calculate the difference value between the candidate benchmark sample and other candidate benchmark samples, and determine whether to use it as a new benchmark sample based on the difference value, so that the sample that is wrongly assigned and has a large difference from other candidate benchmark samples is also used as a benchmark sample, The implementation method is simple, and compared with traditional image matching to directly select benchmark samples, it can effectively increase the reliability of benchmark sample selection, thereby further improving the accuracy of malicious code detection.

In this embodiment, for the training samples in step S1, the samples are first converted into images, and the binary malicious codes are converted into grayscale images. As shown in Figure 3, when this embodiment converts the sample to a grayscale image, since each pixel of the grayscale image is represented by unsigned integer data between [0, 255], the malicious code in binary form is first converted to It is converted into an unsigned integer data matrix, and since the conversion of 8-bit binary data into an integer is greater than 0 and less than 256, the binary file is specifically cut and converted in units of 8 consecutive bits, and the image width can be fine-tuned according to the conversion requirements , to get the grayscale image of each training sample.

Image texture features mainly include statistical texture features, model texture features, signal texture features and structural texture features. In this embodiment, the image texture feature is specifically a signal-type texture feature, and a signal-type texture processing method is used to perform feature extraction. The image texture feature is specifically extracted by using a Gabor filter. This embodiment is based on static features and does not need to run malicious code. Simple to implement.

The Gabor filter is a linear filter used for image edge feature extraction, which can be defined as a sine wave multiplied by a Gaussian function, where it is a sine plane wave for a two-dimensional Gabor filter. Due to the nature of multiplicative convolution, the Fourier transform of the impulse response of the Gabor filter is the convolution of the Fourier transform of its harmonic function and the Fourier transform of the Gaussian function, then the filter consists of a real part and an imaginary step, and the two are orthogonal to each other . The Gabor filter adopted in this embodiment is specifically as follows, wherein the complex expression is:

The real part is:

The imaginary part is:

In the formula, x'=xcosθ+ysinθ, y'=-xsinθ+ycosθ, λ is the wavelength, in the unit of pixel; θ represents the direction, and the value range is 0°≤θ≤360°; ψ represents the phase shift, It belongs to the range of [-180°,180°]; the value of γ determines the ellipticity of the shape of the Gabor function; Σ represents the standard deviation of the Gaussian factor of the Gabor function, and changes with the bandwidth.

Gabor function arrays with different frequencies and different directions can be obtained during image feature extraction. When calculating texture features based on Gabor, the image texture features of each sample can be expressed as T=([a1,a2],[b1,b2],[c1, c2],[d1,d2]), that is, the image texture features are composed of four eigenvalues a, b, c and d, and each eigenvalue consists of a real part (subscript 1) and an imaginary part (subscript 2 )composition.

When matching between samples, the difference value of image texture features between samples is specifically calculated, and the matching between samples is judged according to the size of the difference value. The smaller the difference value of image texture features between samples, the better the match. The formula for calculating the difference between a single sample s _i and s _j is:

In this embodiment, step S12 specifically calculates the Gabor function values of each candidate reference sample and training sample, and the distance value between each candidate reference sample and other candidate reference samples, and calculates each candidate reference sample according to the Gabor function value and distance value. The difference value between the benchmark sample and other candidate benchmark samples.

In this embodiment, the difference between a candidate benchmark sample es _id and other candidate benchmark samples is specifically calculated by the following formula;

p _d (es _id )=∑ _j=0,1,...,N D(es _id ,es _hj )

Among them, es _id is the dth candidate benchmark sample of class i, es _hj is the jth candidate benchmark sample of class h, D(es _id ,es _hj ) is the distance between sample es _id and sample es _hj , h is the family category whose es _id is misassigned, μ is the trade-off coefficient, N is the number of reference samples contained in the family category h, M is the number of reference samples, and l is the length of the image texture feature vector obtained by the G filter. Based on the size of the difference between each candidate benchmark sample and the training sample of the current family category, it can be determined whether it should be used as a new benchmark sample, so as to improve the reliability of the benchmark sample.

For any sample set C with n samples and m family categories, denoted as C={C ₁ ,C ₂ ,…,C _m }, the set C contains n ₁ training samples and n ₂ unknown samples respectively, And n=n ₁ +n ₂ , the detailed steps of selecting candidate reference samples are as follows:

①Randomly select m samples {b ₁₁ ,b ₂₁ ,…,b _m1 } from the training samples as benchmark samples, where b _ij represents the jth benchmark sample from family i, that is, from the training samples of each family category randomly select a training sample as the initial benchmark sample (the first benchmark sample);

②The remaining training samples are matched with the initial benchmark samples respectively, and the wrongly matched samples are counted, that is, the wrongly assigned samples, and the wrongly matched samples are also in the m category, and the wrongly matched samples are used as candidate benchmark samples, assuming that the m category matches A sample of the error is represented as:

es={{es ₁₁ ,es ₁₂ ,...},{es ₂₁ ,es ₂₂ ,...},...,{es _n,1 ,es _n,2 ,...}}

③ Perform secondary matching within the matching error sample set of each family category, specifically: the candidate benchmark sample set of family i is expressed as {es _i1 , es _i2 ,…}, and the Gabor function values of each candidate benchmark sample { gabor _l (es _i1 ), gabor _l (es _i2 ), gabor _l (es _i3 ),…}, and then calculate the difference between different candidate benchmark samples, specifically calculate the sample es _id with respect to family i according to formula (5) difference value, if the difference value of the candidate sample es _id satisfies D(es _id )>ρ, then add a new benchmark sample (second benchmark sample) whose es _id is family i.

In this embodiment, the malicious code to be detected first converts the malicious code to be detected into an image, converts the binary malicious code to be detected into a grayscale image form, and then extracts image texture features, which is the same as the above-mentioned training sample processing method.

In this embodiment, based on the extracted image texture features in step S3, the specific steps for confirming the family category of the malicious code to be detected are:

S31. Respectively obtain the matching results of the malicious code to be detected and each benchmark sample in the benchmark sample set of each family category;

S32. Obtain a comprehensive matching value corresponding to each family category from all matching results of each family category, and judge whether the malicious code to be detected belongs to the corresponding family category according to the comprehensive matching value of each family category.

In this embodiment, the comprehensive matching value is specifically calculated according to the following formula;

in, es _test is the malicious code to be detected, es _ij is the jth benchmark sample of the i-th category, and N is the number of benchmark samples contained in the family category i.

In this embodiment, when the malicious code es _test to be detected is matched with the benchmark sample es _ij , if they match, the matching result is 1, and if they do not match, the matching result is -1. Of course, the matching result can also be set according to actual needs ; Then add up all the matching results obtained by each family category to obtain the final comprehensive matching value, and determine the family category to which it belongs based on the comprehensive matching value.

In this embodiment, when the comprehensive matching value R corresponding to the target family category satisfies R>0, it is determined that the malicious code to be detected belongs to the target family category; otherwise, it is determined that the malicious code to be detected does not belong to the target family category.

The present invention will be further described below by taking the detection and classification of 10 test samples in two family categories as an example.

The training samples used in this embodiment are shown in Table 1.

Table 1: Training sample table.

Step 1: Benchmark sample selection

Step 1.1: Extraction of training sample image texture features

以分别为上述家族(1)中两个训练样本S1(0B06744D7C5822BA585C5992B10ADFA0)、S2(0BDAFFBA037A4880D31C93C0AADCC1FE)、家族(2)中两个训练样本S3(2C69C485A46B03C277B5F88DED0BABF0)、S4(2C9F38EF39CFD73AA52E22869E8ABD90)为例，首先将上述四个恶意The code training sample is converted from a binary file to a grayscale image. For example, a piece of binary code "01100111" is converted into an unsigned integer of 206, which means that the value of the corresponding pixel is 206 after being converted into a grayscale image. The result of the grayscale image is shown in the figure 4, where Figure (a) is Family (2), corresponding to samples S3 and S4 respectively; Figure (b) is Family (2), corresponding to Samples S1 and S2 respectively; then Gabor filter is used to extract texture features of malicious code , the implementation method of the Gabor filter used is specifically shown in the above formulas (1) to (3), and the texture features of the four samples are calculated as follows:

T _{sample S1} = ([3.64589196e-01,1.78531921e-02],[1.11456886e-01,3.62631582e-03],[2.45940133e-01,4.82167451e-03],[3.66851460e-04,1.8853902 04]);

T _{sample S2} = ([3.67820753e-01,2.47166142e-02],[1.12444790e-01,5.22362168e-03],[2.48120037e-01,7.30584538e-03],[3.70103068e-04,3.6496253 04]);

T _{sample S3} = ([3.82683113e-01,1.65478632e-02],[1.16988294e-01,5.31969120e-03],[2.58145706e-01,3.20882018e-03],[3.85057648e-04,4.539929 04]);

T _{sample S4} = ([3.78114609e-01,2.53183776e-02],[1.15591678e-01,5.70669572e-03],[2.55063941e-01,7.49917029e-03],[3.80460797e-04,3.410536 04]).

Step 1.2: Selection of Candidate Benchmark Samples

In this embodiment, family (1) and family (2) respectively provide training sample sets 1 and 2 as shown in Table 1, and each sample set contains 10 training samples. Formula (4) is used to calculate the difference between the training samples for matching, and assuming that the initial reference samples are sample S1 and sample S3, the matching result is: in training sample set 1, sample S7 and sample S10 are assigned incorrectly; training sample In set 2, sample S5 is assigned incorrectly; then these three samples are added as candidate benchmark samples {[c ₁₁ ,c ₁₂ ],[c ₂₁ ]}.

Step 1.3: Second benchmark sample determination

Compute texture features for candidate benchmark samples:

([3.53133564e-01,2.24345224e-02],[1.07954837e-01,4.99747304e-03],[2.38212532e-01,6.49801062e-03],[3.55324746e-04,4.3217174]70e-0 ([3.54380214e-01,2.24449735e-02],[1.08335945e-01,5.00705347e-03],[2.39053482e-01,6.41765146e-03],[3.56579131e-04,3.85045161e-03]), ([3.66485717e-01,2.55705031e-02],[1.12036663e-01,5.15760513e-03],[2.47219465e-01,8.83855001e-03],[3.68759749e-04,3.0242394]).

Using the above formula (5) to calculate the difference between the candidate benchmark sample and other benchmark samples, we can get:

Among them, μ=2 is set.

In this embodiment, it is assumed that the threshold value ρ=0.45, since D(c ₁₁ )>ρ and D(c ₁₂ )>ρ, the candidate reference samples c ₁₁ and c ₁₂ are added as new reference samples (second reference samples), Then the benchmark sample set of family (1) is {b ₁₁ ,c ₁₁ ,c ₁₂ }. At the same time, since there is only one candidate benchmark sample of family 2, it is directly added as a new benchmark sample (second benchmark sample), and the benchmark sample set is {b ₂₁ ,c ₂₁ }.

Step 2: Test sample image texture feature extraction

Convert each test malicious code into a grayscale image, and extract the texture features of the image, the specific method is as described above.

Step 3: Detection Classification

Use the benchmark sample set {b ₁₁ ,c ₁₁ ,c ₁₂ } of family (1) and the benchmark sample set {b ₂₁ ,c ₂₁ } of family (2) to re-match each test sample, where the test sample set contains Ten test samples {S ₁ , S ₂ , S ₃ , S ₄ , S ₅ , S ₆ , S ₇ , S ₈ , S ₉ , S ₁₀ }. The comprehensive matching results of each test sample obtained by using the above formula (6) are specifically:

Table 2: Test matching result table.

test sample S ₁ S ₂ S ₃ S ₄ S ₅ S ₆ S ₇ S ₈ S ₉ S ₁₀ family 1 3 3 3 1 3 0 0 3 1 0 family 2 0 0 0 2 0 2 2 0 2 2

If the comprehensive matching result is greater than 0, it is determined to belong to the corresponding family category, otherwise it is not. According to the above comprehensive matching results, the final test result is that {S ₁ , S ₂ , S ₃ , S ₅ , S ₈ } belong to family (1), and {S4, S6, S7, S9, S10} belong to family (2). It can be seen from the detection results that the above detection method in this embodiment can accurately classify malicious code family categories, and the detection efficiency is high.

The above are only preferred embodiments of the present invention, and do not limit the present invention in any form. Although the present invention has been disclosed above with preferred embodiments, it is not intended to limit the present invention. Therefore, any simple modifications, equivalent changes and modifications made to the above embodiments according to the technical essence of the present invention shall fall within the protection scope of the technical solution of the present invention.

Claims (9)

1. A malicious code detection method based on image matching is characterized by comprising the following steps:

s1, selecting a reference sample: acquiring training samples corresponding to malicious codes of different family categories, respectively converting the training samples into gray level images and extracting corresponding image texture features; selecting a first reference sample from training samples of each family type, selecting a second reference sample according to the difference of image texture characteristics between the first reference sample and the samples, and forming the first reference sample and the second reference sample selected by each family type into a corresponding reference sample set;

s2, image feature extraction: converting the malicious codes to be detected into gray level images, and extracting corresponding image texture features;

s3, testing code classification: and matching the image texture features extracted in the step S2 with the reference sample sets corresponding to the family categories respectively, and confirming the family categories of the malicious codes to be detected according to matching results.

2. The method for detecting malicious codes based on image matching according to claim 1, wherein the specific step of selecting the second reference sample in the step S1 is:

s11, obtaining candidate reference samples: matching the selected first reference samples with the rest training samples respectively, and finding out the training samples which are wrongly distributed in each family type according to the matching result and using the training samples as candidate reference samples;

s12, determining a second reference sample: and respectively calculating difference values between each candidate reference sample and other candidate reference samples in each family type, and if the calculated difference values are greater than a specified threshold value, taking the corresponding candidate reference sample as a second reference sample of the corresponding family type.

3. The method according to claim 2, wherein in step S12, a difference value between each candidate reference sample and the other candidate reference samples is calculated according to the Gabor function value and the distance value by specifically calculating a Gabor function value of each candidate reference sample and a distance value between each candidate reference sample and the other candidate reference samples.

4. The image matching-based malicious code detection method according to claim 3, wherein the difference value between one candidate reference sample and the other candidate reference samples is calculated according to the following formula;

<mrow> <mi>D</mi> <mrow> <mo>(</mo> <mi>e</mi> <mi>s</mi> <mi>i</mi> <mi>d</mi> <mo>)</mo> </mrow> <mo>=</mo> <mfrac> <mn>1</mn> <mi>M</mi> </mfrac> <munder> <mo>&amp;Sigma;</mo> <mrow> <mi>j</mi> <mo>=</mo> <mn>0</mn> <mo>,</mo> <mn>1</mn> <mo>,</mo> <mo>...</mo> <mo>...</mo> <mi>M</mi> </mrow> </munder> <mroot> <mrow> <msub> <mi>&amp;Sigma;</mi> <mrow> <mi>l</mi> <mo>=</mo> <mn>0</mn> <mo>,</mo> <mn>1</mn> <mo>,</mo> <mn>......</mn> </mrow> </msub> <msup> <mrow> <mo>(</mo> <msub> <mi>gabor</mi> <mi>l</mi> </msub> <mo>(</mo> <mrow> <msub> <mi>es</mi> <mrow> <mi>i</mi> <mi>d</mi> </mrow> </msub> </mrow> <mo>)</mo> <mo>-</mo> <msub> <mi>gabor</mi> <mi>l</mi> </msub> <mo>(</mo> <mrow> <msub> <mi>es</mi> <mrow> <mi>i</mi> <mi>j</mi> </mrow> </msub> </mrow> <mo>)</mo> <mo>)</mo> </mrow> <mn>2</mn> </msup> </mrow> <mn>2</mn> </mroot> <mo>+</mo> <mfrac> <mn>1</mn> <mrow> <mi>N</mi> <mi>&amp;mu;</mi> </mrow> </mfrac> <munderover> <mo>&amp;Sigma;</mo> <mrow> <mi>d</mi> <mo>=</mo> <mn>1</mn> </mrow> <mi>N</mi> </munderover> <msub> <mi>p</mi> <mi>d</mi> </msub> <mrow> <mo>(</mo> <msub> <mi>es</mi> <mrow> <mi>i</mi> <mi>d</mi> </mrow> </msub> <mo>)</mo> </mrow> </mrow>

p_d(es_id)＝∑_{j＝0,1,......,N}D(es_id,es_hj)

wherein es_idFor the ith class of candidate reference samples, es_hjFor the h-th class jth candidate reference sample, D (es)_id,es_hj) As samples es_idWith the sample es_hjH is es_idAnd μ is a weighting coefficient, N is the number of reference samples contained in the family class h, M is the number of reference samples, and l is the vector length of the image texture feature.

5. The malicious code detection method based on image matching according to any one of claims 1 to 4, wherein the image texture features are signal type static texture features.

6. The malicious code detection method based on image matching according to any one of claims 1 to 4, characterized in that: the image texture features are obtained by extracting through a Gabor filter.

7. The image matching-based malicious code detection method according to any one of claims 1 to 4, wherein the specific steps of confirming the family category of the malicious code to be detected in the step S3 are as follows:

s31, respectively obtaining matching results of the malicious codes to be detected and all reference samples in the reference sample sets of all family categories;

and S32, respectively obtaining a comprehensive matching value corresponding to each family type according to all matching results of each family type, and judging whether the malicious codes to be detected belong to the corresponding family type according to the comprehensive matching value of each family type.

8. The image matching-based malicious code detection method according to claim 7, wherein the comprehensive matching value is calculated according to the following formula;

<mrow> <mi>R</mi> <mo>=</mo> <msubsup> <mi>&amp;Sigma;</mi> <mrow> <mi>j</mi> <mo>=</mo> <mn>0</mn> </mrow> <mi>N</mi> </msubsup> <msub> <mi>w</mi> <mrow> <mi>i</mi> <mi>j</mi> </mrow> </msub> </mrow>

wherein,es_testfor malicious code to be detected, es_ijIs the jth reference sample of the ith class, and N is the number of reference samples contained in the family class i.

9. The image matching-based malicious code detection method according to claim 8, wherein: and when the comprehensive matching value R corresponding to the target family category meets R >0, judging that the malicious codes to be detected belong to the target family category, otherwise, judging that the malicious codes to be detected do not belong to the target family category.