{"id":60048,"date":"2019-04-15T09:00:48","date_gmt":"2019-04-15T01:00:48","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=60048"},"modified":"2019-03-28T16:51:56","modified_gmt":"2019-03-28T08:51:56","slug":"%e4%b8%80%e7%a8%ae%e5%b0%88%e9%96%80%e5%81%b5%e6%b8%ac%e6%83%a1%e6%84%8f%e7%a8%8b%e5%bc%8f%e8%ae%8a%e7%a8%ae%e7%9a%84%e6%a9%9f%e5%99%a8%e5%ad%b8%e7%bf%92%e6%a8%a1%e5%9e%8b","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=60048","title":{"rendered":"\u4e00\u7a2e\u5c08\u9580\u5075\u6e2c\u60e1\u610f\u7a0b\u5f0f\u8b8a\u7a2e\u7684\u6a5f\u5668\u5b78\u7fd2\u6a21\u578b"},"content":{"rendered":"\n<p>\u60e1\u610f\u7a0b\u5f0f\u8981\u80fd\u767c\u63ee\u4f5c\u7528\uff0c\u9996\u5148\u8981\u80fd\u8eb2\u904e\u8cc7\u5b89\u9632\u79a6\u7684\u5075\u6e2c\u6210\u529f\u6ef2\u900f\u5230\u7cfb\u7d71\u5167\u90e8\u3002\u5b83\u8981\u80fd\u5305\u88dd\u4e26\u507d\u88dd\u81ea\u5df1\uff0c\u8b93\u81ea\u5df1\u770b\u8d77\u4f86\u50cf\u4e00\u822c\u6b63\u5e38\u7684\u7a0b\u5f0f\uff0c\u7b49\u5230\u901a\u904e\u8cc7\u5b89\u95dc\u5361\u4e4b\u5f8c\uff0c\u518d\u986f\u73fe\u51fa\u672c\u6027\u3002\u91dd\u5c0d\u4e0d\u6613\u5075\u6e2c\u7684\u60e1\u610f\u7a0b\u5f0f\uff0c\u6216\u662f\u6a23\u672c\u4e0d\u8db3\uff0c\u7121\u6cd5\u63d0\u4f9b\u6709\u6548\u5206\u6790\u7684\u60e1\u610f\u7a0b\u5f0f\uff0c\u6211\u5011\u63d0\u51fa\u4e86\u4e00\u7a2e\u63a1\u7528\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668 (adversarial autoencoder) \u4e26\u642d\u914d\u8a9e\u610f\u96dc\u6e4a\u78bc (semantic hashing) \u7684<ins><a href=\"https:\/\/blog.trendmicro.com.tw\/?p=55169\"><ins>\u6a5f\u5668\u5b78\u7fd2(Machine learning,ML)<\/ins><\/a><\/ins>\u6a21\u578b\u4f86\u52a0\u4ee5\u5075\u6e2c\u3002<a href=\"https:\/\/www.trendmicro.com.tw\/edm\/Tracking.asp?id=2651&amp;name=20110916\">\u8da8\u52e2\u79d1\u6280<\/a>\u8207\u6fb3\u6d32\u806f\u90a6\u5927\u5b78 (Federation University Australia) \u7814\u7a76\u4eba\u54e1\u5171\u540c\u767c\u8868\u904e\u4e00\u7bc7\u540d\u70ba\u300c<a href=\"https:\/\/documents.trendmicro.com\/assets\/white_papers\/GenerativeMalwareOutbreakDetection.pdf\">\u751f\u6210\u5f0f\u60e1\u610f\u7a0b\u5f0f\u64f4\u6563\u5075\u6e2c<\/a>\u300d(Generative Malware Outbreak Detection) \u7684\u7814\u7a76\u8ad6\u6587\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"450\" src=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2019\/04\/snadq4z.jpg\" alt=\"\" class=\"wp-image-60050\" srcset=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2019\/04\/snadq4z.jpg 800w, https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2019\/04\/snadq4z-300x169.jpg 300w, https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2019\/04\/snadq4z-768x432.jpg 768w, https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2019\/04\/snadq4z-30x17.jpg 30w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\u900f\u8996\u52a0\u5bc6\u7de8\u78bc\u7684\u60e1\u610f\u7a0b\u5f0f<\/strong><\/h2>\n\n\n\n<p>\u60e1\u610f\u7a0b\u5f0f\u4f5c\u8005\u77e5\u9053\uff0c\u60e1\u610f\u7a0b\u5f0f\u5fc5\u9808\u4e0d\u88ab\u767c\u73fe\u624d\u6709\u6a5f\u6703\u5165\u4fb5\u88dd\u7f6e\u6216\u7db2\u8def\u3002\u6240\u4ee5\uff0c\u4ed6\u5011\u6703\u904b\u7528\u5404\u7a2e\u4e0d\u540c\u5de5\u5177\u548c\u6280\u5de7\u4f86\u8eb2\u907f\u5075\u6e2c\uff0c\u6b64\u5916\uff0c\u66f4\u6703\u7528\u76e1\u65b9\u6cd5\u4f86\u63d0\u9ad8\u60e1\u610f\u7a0b\u5f0f\u7684\u5075\u6e2c\u96e3\u5ea6\uff0c\u5305\u62ec\u8eb2\u907f\u6c99\u76d2\u6a21\u64ec\u5206\u6790\u3001\u53cd\u89e3\u8b6f\u3001\u53cd\u9664\u932f\u3001\u8eb2\u907f\u9632\u6bd2\u8edf\u9ad4\u4ee5\u53ca\u8b8a\u5f62\u6216\u591a\u5f62\u7b49\u6280\u5de7\u3002\u4f8b\u5982\u5148\u524d\u66fe\u51fa\u73fe\u5728\u91dd\u5c0d\u6027\u653b\u64ca\u8207\u7db2\u8def\u9593\u8adc\u884c\u52d5\u7576\u4e2d\u7684\n<a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/monero-mining-retadup-worm-goes-polymorphic-gets-an-autohotkey-variant\/\">RETADUP \u8815\u87f2<\/a>\uff0c\u5f8c\u4f86\u4e5f\u6f14\u5316\u51fa\u8b8a\u5f62\u80fd\u529b\u3002\u5176\u65b0\u7684\u8b8a\u7a2e\u662f\u4ee5 AutoHotKey \u7a0b\u5f0f\u78bc\u4f86\u64b0\u5beb\uff0c\u4e14\u8207\u5176\u5148\u524d\u7684\nAutoIt \u8b8a\u7a2e\u4e00\u6a23\uff0c\u90fd\u662f\u7528\u4f86\u767c\u52d5\u865b\u64ec\u52a0\u5bc6\u8ca8\u5e63\u6316\u7926\u653b\u64ca\u3002<\/p>\n\n\n\n<p>\u60e1\u610f\u7a0b\u5f0f\u4e00\u65e6\u7d93\u904e\u52a0\u5bc6\u7de8\u78bc\uff0c\u4e00\u822c\u50b3\u7d71\u7684\u9632\u6bd2\u7cfb\u7d71\u5c31\u5f88\u96e3\u52a0\u4ee5\u5075\u6e2c\u3002\u6211\u5011\u66fe\u5728\u4e00\u7bc7<a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/security-technology\/using-machine-learning-to-detect-malware-outbreaks-with-limited-samples\">\u6587\u7ae0<\/a>\u7576\u4e2d\u6307\u51fa\uff0c\u52a0\u5bc6\u7de8\u78bc\u7684\u554f\u984c\u53ef\u85c9\u7531\u767c\u6398\u540c\u4e00\u60e1\u610f\u7a0b\u5f0f\u5bb6\u65cf\u7576\u4e2d\u4e0d\u8ad6\u4efb\u4f55\u8b8a\u7a2e\u90fd\u5927\u81f4\u7dad\u6301\u4e00\u81f4\u7684\u7279\u5fb5\u4f86\u52a0\u4ee5\u5075\u6e2c\uff0c\u4f8b\u5982\u7a0b\u5f0f\u6307\u4ee4\u5e8f\u5217\u3002\u672c\u6587\u5c07\u5ef6\u7e8c\u5148\u524d\u90a3\u7bc7\u6587\u7ae0\uff0c\u66f4\u9032\u4e00\u6b65\u6df1\u5165\u63a2\u8a0e\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668\u5982\u4f55\u8655\u7406\u7a0b\u5f0f\u6307\u4ee4\u5e8f\u5217\uff0c\u4ee5\u53ca\u8a9e\u610f\u96dc\u6e4a\u78bc\u5728\u6211\u5011\u63d0\u51fa\u7684\u6a21\u578b\u7576\u4e2d\u6709\u4f55\u7528\u9014\u3002<\/p>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\u66f4\u6df1\u5c64\u7684\u5b78\u7fd2\uff1a\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668\u548c\u8a9e\u610f\u96dc\u6e4a\u78bc<\/strong><\/h2>\n\n\n\n<p>\u6211\u5011\u63a1\u7528\u7684\u6a5f\u5668\u5b78\u7fd2\u6a21\u578b (\u6211\u5011\u7a31\u4e4b\u70ba aae-sh) \u662f\u7531\u5169\u500b\u7368\u7acb\u7684\u6a21\u7d44\u6240\u7d44\u6210\u3002\u7b2c\u4e00\u500b\u6a21\u7d44\u4f7f\u7528\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668\u4f86\u64f7\u53d6\u7a0b\u5f0f\u6307\u4ee4\u5e8f\u5217\u7684\u6f5b\u5728\u8868\u793a\n(latent representation)\uff0c\u5982\u6b64\u53ef\u7528\u4f86\u5c0d\u6297\u60e1\u610f\u7a0b\u5f0f\u7684\u52a0\u5bc6\u7de8\u78bc\u3002\u7b2c\u4e8c\u500b\u6a21\u7d44\u8ca0\u8cac\u7522\u751f\u524d\u8ff0\u6f5b\u5728\u8868\u793a\u7684\u985e\u5225\u7de8\u865f (class number)\uff0c\u6b64\u7de8\u865f\u662f\u7d93\u7531\nHDBSCAN \u53e2\u96c6\u6f14\u7b97\u6cd5\u6839\u64da\u9810\u5148\u5b9a\u7fa9\u7684\u9580\u6abb\u503c\u6240\u8a08\u7b97\u51fa\u4f86\u3002<\/p>\n\n\n\n<p><em><strong>\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668<\/strong><\/em><\/p>\n\n\n\n<p>\u91dd\u5c0d\u50c5\u6709\u5c11\u6578\u6a23\u672c\u7684\u60e1\u610f\u7a0b\u5f0f\u64f4\u6563\u5075\u6e2c\uff0c\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668\u7684\u6548\u679c\u986f\u8457\uff0c\u56e0\u70ba\u5373\u4f7f\u53ea\u6709\u5c11\u6578\u7684\u8a13\u7df4\u6a23\u672c\uff0c\u5b83\u9084\u662f\u53ef\u4ee5\u7522\u751f\u5206\u5e03\u5e73\u9806\u7684\u9130\u8fd1\u6a23\u672c\u3002\u4e8b\u5be6\u4e0a\uff0c\u5728\u6211\u5011\u63d0\u51fa\u7684\u6a5f\u5668\u5b78\u7fd2\u6a21\u578b\u4e2d\uff0c\u6bcf\u500b\u60e1\u610f\u7a0b\u5f0f\u985e\u5225\u50c5\u4f7f\u7528\u4e86\u55ae\u4e00\u60e1\u610f\u7a0b\u5f0f\u6a23\u672c\u4f86\u642d\u914d\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668\u9032\u884c\u8a13\u7df4\u3002<\/p>\n\n\n\n<p>\u8a72\u7814\u7a76\u4e2d\uff0c\u60e1\u610f\u7a0b\u5f0f\u64f4\u6563\u5075\u6e2c\u7684\u6838\u5fc3\u67b6\u69cb\u662f\u4f86\u81ea\u65bc\u539f\u59cb\u7684\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/files\/2019\/03\/fig1blog.png\" alt=\"FIGURE 1\"\/><\/figure>\n\n\n\n<p><a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/files\/2019\/03\/fig1blog.png\"><\/a><\/p>\n\n\n\n<p>\u5716 1\uff1a\u60e1\u610f\u7a0b\u5f0f\u64f4\u6563\u5075\u6e2c\u6240\u4f7f\u7528\u7684\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668\u67b6\u69cb\u3002<\/p>\n\n\n\n<p><em>\u8a3b\uff1a\u8f38\u5165 x \u8207\u91cd\u69cb\u5f8c\u7684\u8f38\u5165 p(x) \u90fd\u7dad\u6301\u8457\u6307\u4ee4\u5e8f\u5217\u7684\u7279\u5fb5\u3002<\/em><\/p>\n\n\n\n<p>\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668\u7d50\u5408\u4e86\u81ea\u52d5\u7de8\u78bc\u5668\u8207<a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/adversarial-sample-generation-making-machine-learning-systems-robust-for-security\/\">\u751f\u6210\u5c0d\u6297\u7db2\u8def<\/a> (Generative Adversarial Network\uff0c\u7c21\u7a31 GAN)\u3002GAN\n\u8ca0\u8cac\u5229\u7528\u4e00\u500b\u7dca\u5bc6\u7af6\u722d\u8ff4\u5708\u4f86\u8a13\u7df4\u751f\u6210\u5668 (generator) \u8207\u9451\u5225\u5668 (discriminator) \u3002\u81ea\u52d5\u7de8\u78bc\u5668\u8981\u5728\u6b64\u6a21\u578b\u4e2d\u904b\u4f5c\uff0c\u5fc5\u9808\u5177\u5099\u4ee5\u4e0b\u5c6c\u6027\uff1a<\/p>\n\n\n\n<ul><li>\u5176\u5806\u758a\u52a0\u6b0a\n(stacked weights) \u4e26\u9808\u5c0d\u7a31\u4e14\u7531\u7de8\u78bc\u5668\u8207\u89e3\u78bc\u5668\u5171\u6709\u3002<\/li><li>\u5fc5\u9808\u5177\u5099\nGAN \u7684\u7522\u751f\u5668\u5c6c\u6027\u3002\u7531\u65bc\u7de8\u78bc\u5668\u5177\u5099\u96d9\u91cd\u529f\u80fd\uff0c\u56e0\u6b64\u5b83\u5fc5\u9808\u5177\u5099\u751f\u6210\u5668\u7684\u8a13\u7df4\u6280\u5de7\uff0c\u540c\u6642\u53c8\u7dad\u6301\u5176\u81ea\u52d5\u7de8\u78bc\u5668\u7684\u5c6c\u6027\u3002<\/li><\/ul>\n\n\n\n<p>\u5373\u4f7f\u61c9\u7528\u7a0b\u5f0f\u5167\u7684\u51fd\u5f0f\u8b8a\u63db\u4f4d\u7f6e\u4e5f\u80fd\u52a0\u4ee5\u5075\u6e2c\u7684\u80fd\u529b\uff0c\u5c0d\u65bc\u5075\u6e2c\u60e1\u610f\u7a0b\u5f0f\u64f4\u6563\u4f86\u8aaa\uff0c\u662f\u4e00\u9805\u6709\u5229\u7684\u7279\u6027\u3002\u800c\u4e00\u500b\u5806\u758a\u5377\u7a4d\u81ea\u52d5\u7de8\u78bc\u5668\n(stacked convolutional autoencoder)\uff0c\u5176\u76ee\u6a19\u662f\u8981\u904b\u7528\u8a72\u67b6\u69cb\u7684\u5e73\u79fb\u4e0d\u8b8a\u6027 (translation invariant)<a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/a-machine-learning-model-to-detect-malware-variants\/#_ftn1\">[1]<\/a>\n\u4f86\u8b93\u6a5f\u5668\u5b78\u7fd2\u6a21\u578b\u81ea\u884c\u627e\u51fa\u7a0b\u5f0f\u78bc\u5e8f\u5217\uff0c\u4e0d\u8ad6\u7a0b\u5f0f\u78bc\u5982\u4f55\u6539\u8b8a\u4f4d\u7f6e\u6216\u6574\u5408\u8b8a\u5f62<a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/a-machine-learning-model-to-detect-malware-variants\/#_ftn2\">[2]<\/a>\u3002\u6839\u64da\nAlireza Makhzani \u7b49\u4eba\u7684\u7814\u7a76\u6307\u51fa\uff0c\u5c0d\u6297\u7db2\u8def\u8207\u81ea\u52d5\u7de8\u78bc\u5668\u5169\u8005\u7686\u9700\u63a1\u7528\u96a8\u6a5f\u68af\u5ea6\u4e0b\u964d\u6cd5 (stochastic gradient descent) \u5f7c\u6b64\u9032\u884c<a href=\"https:\/\/arxiv.org\/abs\/1511.05644\">\u5169\u968e\u6bb5<\/a>\n(\u91cd\u69cb\u968e\u6bb5\u8207\u6b63\u898f\u5316\u968e\u6bb5) \u7684\u76f8\u4e92\u8a13\u7df4\uff0c\u4e4b\u5f8c\u518d\u8b93\u5b83\u5011\u8dd1\u500b\u5225\u5c0f\u6279\u6b21 (mini-batch) \u6a23\u672c\u3002<\/p>\n\n\n\n<p>\u7db2\u8def\u67b6\u69cb\u7576\u4e2d\u6709\u4e00\u4e9b\u8d85\u53c3\u6578\n(hyperparameter) \u53ef\u4ee5\u8abf\u6821\uff0c\u5305\u62ec\u591a\u6a23\u5316\u60e1\u610f\u7a0b\u5f0f\u53e2\u96c6\u61c9\u8a72\u5075\u6e2c\u5230\u4ec0\u9ebc\u7a0b\u5ea6\uff0c\u6216\u662f\u6279\u6b21\u7684\u5927\u5c0f\u3002\u8981\u5728\u9019\u6a21\u578b\u4e0b\u8a13\u7df4\u60e1\u610f\u7a0b\u5f0f\u6a23\u672c\uff0cGAN \u751f\u6210\u5668\u7684\u6279\u6b21\u6b63\u898f\u5316\n(batch normalization) \u6709\u5176\u5fc5\u8981\uff0c\u9019\u6709\u52a9\u65bc\u91dd\u5c0d\u6bcf\u4e00\u500b\u53e2\u96c6\u751f\u6210\u4e00\u500b\u4e00\u81f4\u7684\u6f5b\u5728\u8868\u793a\u3002\u8981\u78ba\u5be6\u9054\u6210\u9019\u9805\u76ee\u6a19\uff0c\u6211\u5011\u5728\u91cd\u69cb\u8207\u6b63\u898f\u5316\u968e\u6bb5\u7686\u4f7f\u7528<a href=\"https:\/\/arxiv.org\/abs\/1412.6980\">Adam\noptimizer<\/a> \u4f86\u9032\u884c\u96a8\u6a5f\u68af\u5ea6\u4e0b\u964d\u6cd5\u6700\u4f73\u5316\u3002\u6b64\u5916\uff0c\u6211\u5011\u4e5f\u4f7f\u7528 <a href=\"https:\/\/www.cs.toronto.edu\/~tijmen\/csc321\/slides\/lecture_slides_lec6.pdf\">RMSProp<\/a> \u4f86\u9032\u884c\u5171\u8b58\u6700\u4f73\u5316 (consensus optimization)\uff0c\u4ee5\u6e1b\u5c11\u6a19\u6e96\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668\u8a13\u7df4\u6240\u9020\u6210\u7684\u4e0d\u7a69\u5b9a\u6027\n(RMSProp \u662f\u4e00\u7a2e\u6df1\u5ea6\u795e\u7d93\u7db2\u8def\u6700\u4f73\u5316\u6f14\u7b97\u6cd5)\uff0c\u6700\u5f8c\u518d\u627e\u51fa\u6a21\u578b\u7684\u8d85\u53c3\u6578\u3002<\/p>\n\n\n\n<p>\u8a13\u7df4\u4e00\u65e6\u5b8c\u6210\uff0c\u5373\u53ef\u64f7\u53d6\u7de8\u78bc\u5668\u7684\u8f38\u51fa\u7576\u6210\u6f5b\u5728\u5411\u91cf\u4ee5\u505a\u70ba\u8f38\u5165\u6a23\u672c\uff0c\u7136\u5f8c\u5229\u7528\u6b64\u8f38\u5165\u6a23\u672c\u4f86\u7522\u751f\u8a9e\u610f\u96dc\u6e4a\u78bc\u3002<\/p>\n\n\n\n<p><em><strong>\u8a9e\u610f\u96dc\u6e4a\u78bc<\/strong><\/em><\/p>\n\n\n\n<p>\u8a9e\u610f\u96dc\u6e4a\u78bc\u7684\u4f5c\u7528\u662f\u8981\u5c07\u5c0d\u6297\u81ea\u52d5\u7de8\u78bc\u5668\u7522\u751f\u7684\u6f5b\u5728\u8868\u793a\u8f49\u63db\u6210\u4e00\u500b\u985e\u5225\u7de8\u865f\uff0c\u4f5c\u70ba\u9810\u5224\u7528\u9014\u3002\u8981\u8a08\u7b97\u985e\u5225\u7de8\u865f\uff0c\u4ee5\u5be6\u6578\u8868\u793a\u7684\u6f5b\u5728\u5411\u91cf\u9700\u5148\u4f7f\u7528\u8a13\u7df4\u6a23\u672c\u7684\u4f4d\u5143\u5e73\u5747\u503c\n(bitwise mean value) \u9032\u884c\u4e8c\u5143\u5316 (binarize)\u3002\u63a5\u8457\uff0c\u518d\u8a08\u7b97\u5169\u500b\u6f5b\u5728\u5411\u91cf\u7684\u6f22\u660e\u8ddd\u96e2 (Hamming Distance\uff0c\u4ee3\u8868\u5169\u500b\u76f8\u540c\u9577\u5ea6\u7684\u5b57\u4e32\u4e2d\uff0c\u6709\u5e7e\u500b\u5c0d\u61c9\u4f4d\u7f6e\u4e0a\u7684\u5b57\u7b26\u4e0d\u540c)<a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/a-machine-learning-model-to-detect-malware-variants\/#_ftn3\">[3]<\/a>\u3002\u6700\u5f8c\u518d\u5c07\u6e2c\u8a66\u6a23\u672c\u5206\u6d3e\u5230\u8207\u5176\u8ddd\u96e2\u6700\u8fd1\u7684\u8a13\u7df4\u6a23\u672c\u6240\u5c6c\u985e\u5225\u3002<\/p>\n\n\n\n<p><em><strong>\u5206\u6790\uff1aFlashback \u8b8a\u7a2e<\/strong><\/em><\/p>\n\n\n\n<p>\u5229\u7528\u9019\u500b aae-sh \u6a21\u578b\uff0c\u6211\u5011\u5c31\u80fd\u6e96\u78ba\u767c\u6398\u540c\u4e00\u53e2\u96c6\u5167\u4e3b\u8981\u7279\u5fb5\u8cea\u91cf\n(feature mass) \u76f8\u540c\u7684\u6240\u6709\u60e1\u610f\u7a0b\u5f0f\u8b8a\u7a2e\uff0c\u5373\u4f7f\u662f\u7d93\u904e\u8b8a\u5f62\u6216\u4fee\u6539\u4ea6\u7136\u3002\u5982\u679c\u5c0d aae-sh \u6a21\u578b\u53ef\u5075\u6e2c\u7684\u5bb6\u65cf\u9032\u884c\u8996\u89ba\u5206\u6790\uff0c\u53ef\u767c\u73fe\u540c\u4e00\u5bb6\u65cf\u5167\u7684\u8b8a\u7a2e\u5373\u4f7f\u6709\u4e9b\u5dee\u7570\uff0c\u4ecd\u7136\u53ef\u767c\u73fe\u4e00\u4e9b\u985e\u4f3c\u7684\u6307\u4ee4\u5e8f\u5217\u3002\u6211\u5011\u767c\u73fe\uff0c\u67d0\u4e9b\u60e1\u610f\u7a0b\u5f0f\u5bb6\u65cf\n(\u5982 Flashback) \u5373\u4f7f\u662f\u4e0d\u540c\u7684\u8b8a\u7a2e\u4e5f\u6703\u6709\u4e00\u4e9b\u91cd\u8907\u4f7f\u7528\u7684\u7a0b\u5f0f\u78bc\uff0c\u9019\u6a23 aae-sh \u6a21\u578b\u5c31\u80fd\u6709\u6548\u52a0\u4ee5\u5075\u6e2c\u3002\u8a72\u7814\u7a76\u4e2d\uff0c\u6211\u5011\u5075\u6e2c\u5230\u4e00\u500b\u542b\u6709\u8a31\u591a\nFlashback \u8b8a\u7a2e\u7684\u53e2\u96c6 (\u7b2c 49 \u865f\u53e2\u96c6)\u3002\u8acb\u6ce8\u610f\uff0caae-sh \u4e5f\u6709\u8fa6\u6cd5\u5075\u6e2c\u9577\u5ea6\u4e0d\u540c\u7684\u6a23\u672c\uff0c\u53ea\u8981\u6709\u6a23\u672c\u7576\u4e2d\u542b\u6709\u76f8\u4f3c\u7684\u6307\u4ee4\u5e8f\u5217\u5373\u53ef\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/files\/2019\/03\/figure-6.png\" alt=\"FIGURE 2\"\/><\/figure>\n\n\n\n<p><a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/files\/2019\/03\/figure-6.png\"><\/a><\/p>\n\n\n\n<p>\u5716 2\uff1a\u5c07 aae-sh \u6a21\u578b\u5728\u7b2c\n49 \u865f\u53e2\u96c6\u4e2d\u767c\u73fe\u7684\u60e1\u610f\u7a0b\u5f0f\u6a23\u672c\u6307\u4ee4\u5e8f\u5217\u8996\u89ba\u5316\u5f8c\u6240\u5448\u73fe\u7684\u5716\u5f62\u3002<\/p>\n\n\n\n<p><em>\u8a3b\uff1aX \u8ef8\u4ee3\u8868\u7279\u5fb5\uff0cY \u8ef8\u4ee3\u8868\u6a23\u672c\u7de8\u865f\u3002<\/em><\/p>\n\n\n\n<p>\u6b64\u5916\uff0c\u7531\u65bc aae-sh \u80fd\u6839\u64da\u6307\u4ee4\u5e8f\u5217\u7684\u6a23\u8c8c\u4f86\u5075\u6e2c\u60e1\u610f\u7a0b\u5f0f\u8b8a\u7a2e\uff0c\u6211\u5011\u4e5f\u56e0\u6b64\u767c\u73fe\u4e86\n447 \u500b\u539f\u672c\u4e26\u672a\u6b78\u985e\u5728 Flashback \u5bb6\u65cf\u7684\u8b8a\u7a2e\uff0c\u56e0\u70ba VirusTotal \u7684\u5206\u6790\u5e2b\u662f\u6839\u64da\u5176\u81ea\u5df1\u7684\u7d93\u9a57\u5206\u6790\u4f86\u6b78\u985e\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/files\/2019\/03\/figure-8-01.jpg\" alt=\"FIGURE 3\"\/><\/figure>\n\n\n\n<p><a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/files\/2019\/03\/figure-8-01.jpg\"><\/a><\/p>\n\n\n\n<p>\u5716 3\uff1a\u5716 2 \u4e2d\u7684\u7b2c 49\n\u865f\u53e2\u96c6\u4e2d\u6a23\u672c\u6839\u64da VirusTotal \u7684\u6b78\u985e\u65b9\u5f0f\u3002<\/p>\n\n\n\n<p>\u6211\u5011\u7684\u7814\u7a76\u4e5f\u6307\u51fa\uff0caae-sh \u6a21\u578b\u9664\u4e86\u80fd\u5920\u6e96\u78ba\u5075\u6e2c\u60e1\u610f\u7a0b\u5f0f\u6a23\u672c\u4e4b\u5916\uff0c\u5728\u826f\u6027\u6a23\u672c\u5224\u65b7\u65b9\u9762\u7684\u6e96\u78ba\u7387\u4e5f\u9ad8\u9054\n91%\uff0c\u76f8\u5f62\u4e4b\u4e0b\uff0c\u50b3\u7d71\u5206\u985e\u6a21\u578b\u5247\u6703 100% \u767c\u751f\u8aa4\u5224\u3002<\/p>\n\n\n\n<p>\u8acb\u53c3\u95b1\u6211\u5011\u7684\u7814\u7a76\u8ad6\u6587\u300c<a href=\"https:\/\/documents.trendmicro.com\/assets\/white_papers\/GenerativeMalwareOutbreakDetection.pdf\">\u751f\u6210\u5f0f\u60e1\u610f\u7a0b\u5f0f\u64f4\u6563\u5075\u6e2c<\/a>\u300d(Generative Malware Outbreak\nDetection) \u4f86\u4e86\u89e3\u6709\u95dc\u6211\u5011\u6a5f\u5668\u5b78\u7fd2\u6a21\u578b\u5728\u6709\u9650\u6a23\u672c\u689d\u4ef6\u4e0b\u5075\u6e2c\u60e1\u610f\u7a0b\u5f0f\u64f4\u6563\u7684\u65b9\u6cd5\u3001\u7d50\u679c\u8207\u5206\u6790\u3002<\/p>\n\n\n\n<p><a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/a-machine-learning-model-to-detect-malware-variants\/#_ftnref1\">[1]<\/a> Jonathan Masci, Ueli Meier, Dan Cire\u015fan, J\u00fcrgen Schmidhuber.\u201cStacked Convolutional Auto-encoders for Hierarchical\nFeature<\/p>\n\n\n\n<p>Extraction.\u201dIn <em>Artificial Neural Networks\nand Machine Learning<\/em><em>\u2013<\/em><em>ICANN 2011<\/em>, pages 52-59, September 2014.<\/p>\n\n\n\n<p><a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/a-machine-learning-model-to-detect-malware-variants\/#_ftnref2\">[2]<\/a> Ilsun You and Kangbin Yim.\u201cMalware Obfuscation Techniques: A Brief Survey.\u201d<em>In 2010 International Conference on Broadband, Wireless Computing,\nCommunication and Application<\/em>, pages\n297-300, 4 November 2010.<\/p>\n\n\n\n<p><a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/a-machine-learning-model-to-detect-malware-variants\/#_ftnref3\">[3]<\/a> Ruslan Salakhutdinov and Geoffrey Hinton.\u201cSemantic Hashing.\u201dIn <em>International Journal of\nApproximate Reasoning<\/em>, pages 969-978, 7 July, 2009.<\/p>\n\n\n\n<p>\u539f\u6587\u51fa\u8655\uff1a<a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/a-machine-learning-model-to-detect-malware-variants\/\">A Machine Learning\nModel to Detect Malware Variants<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u60e1\u610f\u7a0b\u5f0f\u8981\u80fd\u767c\u63ee\u4f5c\u7528\uff0c\u9996\u5148\u8981\u80fd\u8eb2\u904e\u8cc7\u5b89\u9632\u79a6\u7684\u5075\u6e2c\u6210\u529f\u6ef2\u900f\u5230\u7cfb\u7d71\u5167\u90e8\u3002\u5b83\u8981\u80fd\u5305\u88dd\u4e26\u507d\u88dd\u81ea\u5df1\uff0c\u8b93\u81ea\u5df1\u770b\u8d77\u4f86\u50cf\u4e00\u822c\u6b63 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_wpscppro_dont_share_socialmedia":false,"_wpscppro_custom_social_share_image":0,"_facebook_share_type":"","_twitter_share_type":"","_linkedin_share_type":"","_pinterest_share_type":"","_linkedin_share_type_page":"","_instagram_share_type":"","_medium_share_type":"","_threads_share_type":"","_google_business_share_type":"","_selected_social_profile":[],"_wpsp_enable_custom_social_template":false,"_wpsp_social_scheduling":{"enabled":false,"datetime":null,"platforms":[],"status":"template_only","dateOption":"today","timeOption":"now","customDays":"","customHours":"","customDate":"","customTime":"","schedulingType":"absolute"},"_wpsp_active_default_template":true},"categories":[3455,3024,4126],"tags":[2962,2961,2068],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/60048"}],"collection":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=60048"}],"version-history":[{"count":0,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/60048\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=60048"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=60048"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=60048"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}