Abstract:

Machine learning algorithm often needs to use a large amount of annotation data to train a classifier. However, it’s hard to collect malicious Web samples because of its short survival time. To solve this problem, a method based on Generative Adversarial Network（GAN） is proposed. The scheme uses a small amount of Web page sample set to train a generative adversarial network and generate Web page samples through its generator. Besides, several discriminators are added to the classical GAN structure to improve the quality of the generated samples. The global discriminator aims to improve the quality of the whole generated sample, and each feature discriminator makes the generated sample become detailed. As shown in the tests, the samples generated by the proposed scheme can be used to train the malicious Web page classifier. And its quality is better than the quality of the samples generated by the condition generative adversarial network and the conditional variational autoencoder.

Key words: malicious Web page detection, malicious Web page feature, machine learning, Generative Adversarial Network（GAN）, multiple discriminator

摘要：

针对基于机器学习算法识别恶意网页时恶意网页样本收集困难的问题，提出了一种基于生成对抗网络（GAN）的扩展恶意网页样本数据集的方法（WS-GAN），使用少量的原始样本数据训练生成对抗网络，利用生成器模拟生成网页样本。同时在原有生成对抗网络的结构中加入了多个判别器：全局判别器判别整体样本的真伪，控制生成样本整体的质量；各特征判别器判别其对应类别特征数据的真伪，控制生成样本细节部分的质量。实验结果表明，WS-GAN生成的网页特征样本可用于恶意网页分类器的训练，并且其生成样本的质量优于条件生成对抗网络和条件变分自编码器生成样本的质量。

关键词: 恶意网页识别, 恶意网页特征, 机器学习, 生成对抗网络, 多判别器