A backdoor adversarial sample generation method for pe malware detection model

Abstract

The invention relates to a backdoor confrontation sample generation method based on a R-DBSCAN PE malware detection model, and belongs to the field of computer malware detection. The main purpose is to solve the problem that the malware detection model is difficult to attack in the black box situation. The invention first obtains PE samples from the public data set and trains the agent training model, adopts the SHAP value to reduce the dimension data set; adopts the R-DBSCAN method to cluster the samples, and takes the central node of each cluster as the sampling point to construct a new data set ;Train the neural network model; input malicious and benign sample files respectively, record the neurons that have a greater impact on the classification results according to the changes in the weights of neurons within the neural network; embed strings of any length into empty PE files, according to the weights of neurons The change situation takes the string that has a greater impact on it and records the neuron; the trigger is embedded in the original malicious PE file, and the label is modified to achieve adversarial training of the neural network.

Description

technical field [0001] The invention relates to a backdoor confrontation sample generation method for a PE malware detection model, which belongs to the field of computer malware detection. Background technique [0002] The detection technology for malware has been developing rapidly, but the number of new malware is still very considerable every year. With the development of deep learning, PE malware detection methods based on deep learning have become diverse. Statically analyze PE files, extract hexadecimal data features of files, and use deep learning methods to learn features. These methods have been able to detect malware with high accuracy. However, this type of malware detection model ignores the security of the detection system itself and the reliability of the data during the development process. If the malware detection model encounters a backdoor inserted by an attacker during the training process, the detection model will guarantee the normal input under normal...

AI Technical Summary

Problems solved by technology

[0003] At present, the generation method of adversarial samples for PE malware has the characteristics of poor generalization ability and high computational overhead. The construction of adversarial samples is generally designed for a specific detection model, which limits the generalization ability of adversarial samples on other detection models.

The construction of black-box adversarial samples requires a large number of query operations on the detection model to clarify the deceptive effect of the adversarial samples on the model. In practice, a large number of queries are time-consuming and laborious, which reduces the practicability of the adversarial sample generation method.

Images