{"action":"created","issue":{"url":"https://api.github.com/repos/mylamour/blog/issues/38","repository_url":"https://api.github.com/repos/mylamour/blog","labels_url":"https://api.github.com/repos/mylamour/blog/issues/38/labels{/name}","comments_url":"https://api.github.com/repos/mylamour/blog/issues/38/comments","events_url":"https://api.github.com/repos/mylamour/blog/issues/38/events","html_url":"https://github.com/mylamour/blog/issues/38","id":354997966,"node_id":"MDU6SXNzdWUzNTQ5OTc5NjY=","number":38,"title":"从阿里第三届云安全算法比赛看检测模型的绕过方式","user":{"login":"mylamour","id":12653147,"node_id":"MDQ6VXNlcjEyNjUzMTQ3","avatar_url":"https://avatars3.githubusercontent.com/u/12653147?v=4","gravatar_id":"","url":"https://api.github.com/users/mylamour","html_url":"https://github.com/mylamour","followers_url":"https://api.github.com/users/mylamour/followers","following_url":"https://api.github.com/users/mylamour/following{/other_user}","gists_url":"https://api.github.com/users/mylamour/gists{/gist_id}","starred_url":"https://api.github.com/users/mylamour/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mylamour/subscriptions","organizations_url":"https://api.github.com/users/mylamour/orgs","repos_url":"https://api.github.com/users/mylamour/repos","events_url":"https://api.github.com/users/mylamour/events{/privacy}","received_events_url":"https://api.github.com/users/mylamour/received_events","type":"User","site_admin":false},"labels":[{"id":740181901,"node_id":"MDU6TGFiZWw3NDAxODE5MDE=","url":"https://api.github.com/repos/mylamour/blog/labels/%E5%AD%A6%E4%B9%A0","name":"学习","color":"8958f4","default":false},{"id":740181998,"node_id":"MDU6TGFiZWw3NDAxODE5OTg=","url":"https://api.github.com/repos/mylamour/blog/labels/%E5%AE%89%E5%85%A8","name":"安全","color":"33bc0d","default":false},{"id":740177572,"node_id":"MDU6TGFiZWw3NDAxNzc1NzI=","url":"https://api.github.com/repos/mylamour/blog/labels/%E6%80%BB%E7%BB%93","name":"总结","color":"431ed8","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-29T05:03:47Z","updated_at":"2018-08-30T02:02:41Z","closed_at":null,"author_association":"OWNER","body":"本文是[恶意软件与数据分析](http://iami.xyz/AliSEC3/)的下篇，针对此次的阿里云安全算法比赛过程的中的总结，完整PPT不放了。下面展示一下一些简单的统计分析和检测绕过。\r\n\r\n# 统计特征\r\n5类不同类型的恶意样本的api调用如下所示。\r\n\r\n![image](https://user-images.githubusercontent.com/12653147/44760779-fe8bdb00-ab72-11e8-8d83-f59774414591.png)\r\n\r\n![image](https://user-images.githubusercontent.com/12653147/44760793-08add980-ab73-11e8-9644-ae749bba138c.png)\r\n\r\n![image](https://user-images.githubusercontent.com/12653147/44760795-0b103380-ab73-11e8-800f-de02a84c3f4d.png)\r\n\r\n![image](https://user-images.githubusercontent.com/12653147/44760799-0ea3ba80-ab73-11e8-9df2-6b633eeee4d4.png)\r\n\r\n\r\n![image](https://user-images.githubusercontent.com/12653147/44760749-de5c1c00-ab72-11e8-8a08-0ff277e7e7b7.png)\r\n\r\n取基本5类都调用的api绘制，分析其差异,这个是为了，分析在5类中都出现的api的调用次数的规律。\r\n![image](https://user-images.githubusercontent.com/12653147/44763391-a60e0b00-ab7d-11e8-8bff-0163a5f15c20.png)\r\n缩放比例尺，到前一百万的调用\r\n![image](https://user-images.githubusercontent.com/12653147/44763725-149f9880-ab7f-11e8-871f-95ae092f2bc4.png)\r\n\r\n\r\n# 检测绕过\r\n\r\n![image](https://user-images.githubusercontent.com/12653147/44764297-9ee8fc00-ab81-11e8-854d-336171a36480.png)\r\n\r\n![image](https://user-images.githubusercontent.com/12653147/44764398-1028af00-ab82-11e8-94f3-fc164c448af5.png)\r\n\r\n![image](https://user-images.githubusercontent.com/12653147/44764355-e5d6f180-ab81-11e8-8426-07df5eb0950a.png)\r\n\r\n![image](https://user-images.githubusercontent.com/12653147/44764390-0a32ce00-ab82-11e8-8867-9e855db23aa7.png)\r\n\r\n![image](https://user-images.githubusercontent.com/12653147/44764315-b58f5300-ab81-11e8-9a5b-3bf20db609d7.png)\r\n\r\n# Other\r\n\r\n* 集成方法真不错，n个svm bagging效果挺好的，但是训练的时间慢\r\n* 针对特定场景进行的机器模型预测，效果还是很好的。但是通用的话，就不太现实了。效果也差\r\n\r\n# References\r\n* [下载: 从样本统计出来的数据](https://github.com/mylamour/blog/files/2330584/datas.tar.gz)"},"comment":{"url":"https://api.github.com/repos/mylamour/blog/issues/comments/417164969","html_url":"https://github.com/mylamour/blog/issues/38#issuecomment-417164969","issue_url":"https://api.github.com/repos/mylamour/blog/issues/38","id":417164969,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNzE2NDk2OQ==","user":{"login":"mylamour","id":12653147,"node_id":"MDQ6VXNlcjEyNjUzMTQ3","avatar_url":"https://avatars3.githubusercontent.com/u/12653147?v=4","gravatar_id":"","url":"https://api.github.com/users/mylamour","html_url":"https://github.com/mylamour","followers_url":"https://api.github.com/users/mylamour/followers","following_url":"https://api.github.com/users/mylamour/following{/other_user}","gists_url":"https://api.github.com/users/mylamour/gists{/gist_id}","starred_url":"https://api.github.com/users/mylamour/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mylamour/subscriptions","organizations_url":"https://api.github.com/users/mylamour/orgs","repos_url":"https://api.github.com/users/mylamour/repos","events_url":"https://api.github.com/users/mylamour/events{/privacy}","received_events_url":"https://api.github.com/users/mylamour/received_events","type":"User","site_admin":false},"created_at":"2018-08-30T02:02:41Z","updated_at":"2018-08-30T02:02:41Z","author_association":"OWNER","body":"有时候很多事情不需要解释，也没有解释的意义。有则改之，无则加勉吧"}}
{"actor":{"display_login":"mylamour"}}