Patent Document ID: 9349006
Application ID: 13990146
Patent Status: 1

Claim One:
1. A method for program identification based on machine learning, characterized by comprising: analyzing an inputted unknown program, and extracting a feature of the unknown program; coarsely classifying the unknown program according to the extracted feature; said extracting a feature of the unknown program and coarsely classifying the unknown program according to the extracted feature comprise: extracting a class behavior characteristic in the unknown program, wherein the class behavior characteristic comprises an import table library feature and an application programming interface API feature of an import table; and coarsely classifying the unknown program according to the extracted class behavior characteristic; or, said extracting a feature of the unknown program and coarsely classifying the unknown program according to the extracted feature comprise: extracting a structural feature of a PE file in the unknown program; and coarsely classifying the unknown program according to the extracted structural feature of a PE file; said structural feature of a PE file comprises at least one of the following features: a PE file header feature, a PE standard header feature, a PE optional header feature, a data directory feature, a commonly used section table feature; according to a result of the coarse classification, inputting the unknown program into a decision making machine for judging, which decision making machine is generated by training and corresponds to the result of the coarse classification; and outputting an identification result of the unknown program, wherein the identification result is a malicious program or a non-malicious program.