Malicious code family classification method

The invention provides a malicious code family classification method, relates to the technical field of data processing, and aims to evaluate a protection system to determine the attack and defense confrontation level of a local area network, call malicious code confrontation records, construct an attack and defense link set and construct a variant evolution system in combination with a variant traceability module. And traversing the low-code template library in combination with the homologous relationship to extract malicious feature codes and generate common code snippets, and configuring a pre-classification principle to classify malicious code families, thereby solving the problems that in the prior art, homologous association processing and logic architecture construction aiming at malicious code evolution are lacked, and the malicious code family classification cannot be combined, so that the malicious code family classification efficiency is low. The technical problems of insufficient classification re