Convolutional neural network, pyramid strip pooling method and malicious software classification method

Abstract

The invention discloses a convolutional neural network, a pyramid strip pooling method and a malicious software classification method. The pyramid strip pooling method comprises a data size calculation step, a strip-shaped pooling core size calculation step, a data filling step, a step of carrying out strip-shaped pooling on filled data and a pooling result connection step. In the convolutional neural network, the pooling layer performs pooling processing on the data by using the pooling method. According to the malicious software classification method, the convolutional neural network adopting the pooling method is used for classifying the malicious software grey-scale maps. According to the pyramid strip pooling method, the convolutional neural network and the classification method, theclassification and recognition accuracy of images with irregular sizes such as malicious software grey-scale maps can be improved, and the image compression is less than that of a traditional neural network, and the processing efficiency is higher.

Description

technical field [0001] The invention relates to the field of machine learning, in particular to a convolutional neural network training model, a convolutional neural network pyramid strip pooling method, and a method for classifying malware by using the pyramidal strip pooling convolutional neural network. Background technique [0002] With the continuous innovation of network big data technology, a variety of analysis models have emerged for the analysis of behavior. Among them, the most common one is the use of artificial intelligence to extract and analyze behavioral features of big data. As for artificial intelligence, it is formed by machine learning of big data based on neural network. One of the common neural network models is the convolutional neural network. Conventional convolutional neural networks cannot directly process images of irregular sizes (such as grayscale images of malware), resulting in unsatisfactory learning effects on irregular images. [0003] In...

AI Technical Summary

Problems solved by technology

[0005] Chinese patent document CN105718960A discloses an image sorting model method based on convolutional neural network and spatial pyramid matching, which includes three steps: convolutional neural network, approximate nearest neighbor matching algorithm, and similar spatial pyramid matching algorithm, but the method is Segment the image at different resolutions, perform technical statistics on the features belonging to the same category in the same area at each resolution, and finally use the feature histogram of an image obtained by weighted connection of different features as the image feature , this method has certain advantages in the characteristics of traditional images such as numbers and animal heads, but the effect of classifying images corresponding to malware needs to be improved

Chinese patent document CN103839074A discloses an image classification method based on sketch line segment information and spatial pyramid matching. The pyramid matching method divides the image and extracts SIFT features, merges the features and performs clustering, extracts statistical features from the line segments of the initial sketch image, uses the spatial pyramid to match the kernel function and finally classifies eight steps, but this method uses the spatial pyramid to extract features to solve Image detail information is not universally adaptable to malware grayscale images

Chinese patent document CN106991440A discloses an image classification method based on a spatial pyramid-based convolutional neural network. The method includes two main steps: forward propagation to obtain a convolutional neural network and reverse adjustment. Malware Image Classification of Features

Chinese patent document CN106548073A discloses a method for screening malicious APKs based on convolutional neural networks. The method includes decompiling the APK file and analyzing it to obtain a call graph, performing call graph convolution according to security-sensitive functions and high-frequency functions, and convolving the result There are five steps to pass in the pooling layer of the network model, then connect to the hidden layer and output layer of the convolutional neural network model, and obtain the detection results, but it uses the API features called by the malware instead of the grayscale image processing method of the malware

[0006] In the article "Spatial Pyramid Pooling in Deep Convolutional Networks for Visual Recognition", Kaiming He et al. disclose a method for image recognition using a convolutional neural network constructed by a spatial pyramid, including an input layer, a hidden layer, a pooling layer, and a spatial pyramid. Layer and output layer are five steps. This method can achieve the recognition effect on variable-sized images, but this method works on pictures with typical image features, and cannot be applied to malware grayscale images with prominent strip features.

In the article "A Deep LearningFramework for Hyperspectral Image Classification using Spatial PyramidPooling", Jun Yue et al. disclosed a classification method for hyperspectral images based on deep learning of spatial pyramids, including stacked autoencoders (SAEs) for high-level feature extraction, Deep Convolutional Neural Networks (DCNNs) extracts rich features from training data and performs logistic regression classification in three steps. This method acts on conventional images and cannot directly process images of variable sizes.

Images