Malicious File Detection Technology Based on Random Forest Algorithm
AssigneeBluedon Information Security Technologies Corp.
InventorsZonggui Ke, Baoming Zhang, Xiaoning Qin
Life of this patent
Estimating the term…
Abstract
The present invention discloses a malicious file detection technology based on a random forest algorithm. In order to solve the shortcomings or defects of detecting a malicious file by using a feature matching method in the conventional art, a solution of extracting an effective feature and detecting the malicious file by using a machine learning algorithm is adopted, and thus the purpose of accurately and effectively identifying known and unknown malicious file is achieved.
Claims3
A malicious file detection technology based on a random forest algorithm, wherein the technology comprises the steps of constructing 9 types of behavior features by collecting behavior information such as file information, network information, registry information and process information of a malicious file and a normal file in a sandbox to form a feature vector;
- the feature vector serves as input data of a machine learning algorithm, a random forest of an integrated algorithm is selected, and a supervised detection model is established;
- and when behavior data of a new file is generated, the model can accurately and effectively identify whether the file is malicious or not.
Dependencies are inferred from the claim text.