Abstract: With the continuous evolution of hacking technology, the iterative upgrades of malicious code variants have been acclerating and the number of malicious codes has exploded. How to rapidly and accurately detect malicious code has become a challenging research hotspot in the realm of cybersecurity. The unique gating mechanism of long shortterm memory network (LSTM) can selectively retain important historical information. Moreover, it demonstrates excellent performance for the sequential dependence of data on time series, which can effectively solve the problem of gradient vanishing or gradient explosion that may occur when traditional RNNs deal with such problems. This distinctive sequential processing capability of LSTM is particularly important for malware detection, thus learning to its extensive application in this area. This paper comprehensively sorts out and summarizes the application of LSTM in malicious code detection from five aspects, including the detection method of malicious code, the basic model and variants of LSTM, the application of LSTM in malicious code detection, the performance analysis of LSTM in malicious code detection, and the future development direction of LSTM in the field of malicious code detection, aiming to facilitating further research and improvement of existing methods for malicious code detection.

Key words: LSTM(long shortterm memory network), malicious code detection, code security, cyberspace security, information security

摘要： 随着黑客技术的不断演进，恶意代码变种迭代升级加速，恶意代码数量爆炸性增长.如何快速准确地对恶意代码进行检测是网络安全领域具有挑战性的研究热点.长短期记忆网络(long shortterm memory network, LSTM)独有的门控机制，能够有选择性地保留重要的历史信息，同时对于数据在时间序列上的前后依赖关系具有良好性能，能够有效解决传统循环神经网络(recurrent neural network, RNN)在处理此类问题时可能产生的梯度消失或梯度爆炸困扰.LSTM这种独特时序处理能力对于恶意软件检测尤为重要，因此LSTM在恶意软件检测中得到了广泛的应用.从恶意代码的检测方法、LSTM的基本模型及变种、LSTM在恶意代码检测中的应用、LSTM在恶意代码检测中的性能分析、LSTM在恶意代码检测领域未来发展方向5个方面，对LSTM在恶意代码检测中的应用情况进行了全方位的整理和归纳，以期为恶意代码检测现有方法的进一步研究和改进提供帮助.

关键词: 长短期记忆网络, 恶意代码检测, 代码安全, 网络空间安全, 信息安全