Method, system, and device for inferring malicious code rule based on deep learning method

A system for inferring malicious code rule based on a deep learning method, comprising:

• one or more processors;
• a memory;
• and
• one or more programs stored in the memory, when the one or more programs are executed by the one or more processors, the one or more processors are configured:
• to obtain malicious samples and reference samples corresponding to the malicious samples, wherein the malicious samples are dex files carrying malicious codes, and the reference samples are files without malicious codes;
• to parse each malicious sample and each reference sample into character stings, and to extract key character stings from the character strings according to a preset rule, wherein the key character strings extracted from the malicious samples are used as attribution data of the malicious samples, and the key character strings extracted from the reference samples are used as attribution data of the reference samples;
• to train the key character strings using a word2vec principle to obtain a first trained result including vectors of the attribution data of the malicious samples and vectors of the attribution data of the reference samples;
• to compare a difference between the vectors of the attribution data of the malicious samples and the vectors of the attribution data of the corresponding reference samples, to keep the vectors of the attribute data with a difference greater than a preset threshold, and to sum respective dimensional components of the kept vectors of the attribution data, to construct malicious sample feature vectors;
• to extract character strings in a preset range from the key character strings according to the malicious sample feature vectors, and to train the character strings in the preset range using the word2vec principle again to obtain a second trained result;
• and
• to acquire a character string rule of malicious codes according to the second trained result.

A non-transitory storage medium, configured to store application programs, wherein the application programs are configured to execute a method for inferring a malicious code rule based on a deep learning method, comprising:

• obtaining malicious samples and reference samples corresponding to the malicious samples, wherein the malicious samples are dex files carrying malicious codes, and the reference samples are files without malicious codes;
• parsing each malicious sample and each reference sample into character stings, and extracting key character stings from the character strings according to a preset rule, wherein the key character strings extracted from the malicious samples are used as attribution data of the malicious samples, and the key character strings extracted from the reference samples are used as attribution data of the reference samples;
• training the key character strings using a word2vec principle to obtain a first trained result including vectors of the attribution data of the malicious samples and vectors of the attribution data of the reference samples;
• comparing a difference between the vectors of the attribution data of the malicious samples and the vectors of the attribution data of the corresponding reference samples, keeping the vectors of the attribute data with a difference greater than a preset threshold, and summing respective dimensional components of the kept vectors of the attribution data, to construct malicious sample feature vectors;
• extracting character strings in a preset range from the key character strings according to the malicious sample feature vectors, and training the character strings in the preset range using the word2vec principle again to obtain a second trained result;
• and
• acquiring a character string rule of malicious codes according to the second trained result.