Abstract: In recent years,malicious codes have become increasingly rampant,with both the quantity and types showing a rapid growth trend.Therefore,machine learning methods have been widely introduced to improve the efficiency of malicious code identification and classification.This paper focuses on the multi-classification task of malicious codes,adopts static analysis methods,and combines technologies such as disassembly,graph construction,as well as graph theories to extract features from the original files of malicious code samples.Based on the traditional CFG features and bytecode features,the IFG feature is proposed.The IFG feature,CFG feature,and bytecode feature are respectively used to train machine learning models for a horizontal comparison experiment.From the training effect:Compared with the CFG feature,using the IFG feature,the model’saccuracy rate increases by about 5%;compared with the bytecode feature,using the IFG feature,the model’s accuracy rate increases by 0.3%,and the mo-del’s training time is shortened by more than 60%.

Key words: Malicious code, Instruction flow graph, Classification, Machine learning