.png){kind=icon}
返回
Effective method for detecting malicious PowerShell scripts based on hybrid features
.png){kind=icon}
PRE
AI
DOI：10.1016/j.neucom.2021.03.117.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
At present, network attacks are rampant in the Internet world, and the attack methods of hackers are changing steadily. PowerShell is a programming language based on the command line and.NET framework, with powerful functions and good compatibility. Therefore, hackers often use PowerShell malicious scripts to attack the victims in APT attacks. When these malicious PowerShell scripts are executed, hackers can control the victim's computer or leave a backdoor on their computers. In this paper, a detection model of malicious PowerShell scripts based on hybrid features is proposed, we analyzed the differences between malicious and benign samples in text characters, functions, tokens and the nodes of the abstract syntax tree. Firstly, the script of PowerShell is embedded by FastText. Then the textual features, token features and the nodes features of PowerShell code extracted from the abstract syntax tree are added. Finally, the hybrid features of scrips will be classified by a Random Forest classifier. In the experiment, the malicious scripts are inserted into the benign scripts to weaken the features of the malicious samples in the level of abstract syntax tree nodes and tokens, which makes the scripts more complex. Even in such a complex data set, the proposed model which is based on hybrid features still achieves an accuracy of 97.76% in fivefold cross-validation. Moreover, the accuracy of this proposed model on the original scripts is 98.93%, which means that the proposed model has the ability to classify complex scripts. (c) 2021 Elsevier B.V. All rights reserved.
Keyword:
Powershell
Abstract syntax tree
Scripts detection
Machine learning
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
6.5
论文数:
2.5W
被引数:
6.5W
机构
引用论文
A Many Objective-Based Feature Selection Model for Anomaly Detection in Cloud Environment云环境下基于多目标特征选择的异常检测模型.png)
IEEE ACCESS
OAAI
IEEE ACCESSIF3.6
OAAI分享收藏Mental Health Smartphone Apps: Review and Evidence-Based Recommendations for Future Developments精神卫生智能手机应用程序: 对未来发展的审查和基于证据的建议OAAI
OAAI分享收藏分享收藏
查看更多内容