Malicious code classification method based on Hash function and FPN-Transformer

Abstract

The invention relates to a malicious code classification method based on a Hash function and an FPN-Transform, and the method comprises the steps: carrying out the compression processing of to-be-classified code file data through employing the Hash function, reducing the dimension of feature data, and reducing the noise; the feature pyramid network FPN and a Transform model are combined, an FPN-Transform model is constructed, and multi-level and multi-view feature data are provided for the multi-layer regression feature extraction model; and integrating and fusing the features of different levels extracted by the FPN-Transform model by using a multi-layer regression feature extraction model, and outputting a final code classification result according to a fusion result. According to the method, through effective compression and efficient extraction of data features, the performance and practicability of malicious code classification tasks are remarkably improved; feature fusion and classification are carried out through an autocorrelation matrix classifier, and the accuracy and generalization ability of the model in practical application are optimized.

Description

Technical Field

[0001] The invention belongs to the field of network security, and in particular relates to a malicious code classification method based on a Hash function and an FPN-Transformer. Background Art

[0002] Malware family classification is usually performed by monitoring network activities and analyzing the behavioral characteristics of malware. These classification methods have a specific purpose, analyzing the activity patterns and attack strategies of malware in different network environments. Among them, many malicious code families show similar attack characteristics, but their behaviors are not exactly the same, but have some variant characteristics. These characteristics may represent specific attack intentions or malicious activities, such as data theft, system destruction or other security threats. Therefore, the accurate identification and classification of these malicious code family characteristics is of great practical significance for improving the effectiveness of network security protection measures.

[0003] The sample size of malicious code is huge and growing explosively. Although early classification methods based on rules and signatures have made some progress, they face the problems of slow model updates and high false positive rates. With the development of machine learning technology, especially the introduction of deep learning models, malicious code detection and classification technology has made significant progress. However, traditional deep learning methods often rely on large amounts of high-quality annotated data when dealing with malicious code, and are susceptible to the "neural network model collapse" phenomenon or "overfitting", which leads to a decrease in the generalization ability and practicality of classification models in practical applications. Existing classification methods often face problems such as insufficient feature extraction and high resource consumption when dealing with complex and changeable malicious code families. Summary of the invention

[0004] The technical problem of the present invention is that the existing malicious code classification method based on deep learning network relies on high-quality data and is susceptible to the collapse or overfitting of the neural network model, resulting in a decrease in the generalization ability and practicality of the model, especially when processing large-scale or low-quality data sets, facing the problems of high resource consumption and insufficient accuracy.

[0005] The purpose of the present invention is to provide a malicious code classification method based on Hash function and FPN-Transformer to address the above problems. The method reduces the dependence on high-quality data by improving data preprocessing and feature extraction mechanism, and optimizes feature expression and classification efficiency by combining Feature Pyramid Networks (FPN) with Transformer model, thereby improving the accuracy and generalization ability of the model.

[0006] In order to achieve the above object, the technical solution provided by the present invention is: The malicious code classification method based on Hash function and FPN-Transformer uses hash function to compress the code file data to be classified, reduce the dimension of feature data and reduce noise; combines the feature pyramid network FPN and Transformer model to construct the FPN-Transformer model, and provides multi-level and multi-perspective feature data for the multi-layer regression feature extraction model; uses the multi-layer regression feature extraction model to integrate and fuse the features of different levels extracted by the FPN-Transformer model, and outputs the final code classification result according to the fusion result.

[0007] The malicious code family classification method comprises the following steps: Step 1: Data preprocessing: using a natural language processing model to extract preliminary feature data from the code files or code assembly to be classified, capturing the semantic and structural information of the code; Step 2: Perform hash random compression processing on the feature data obtained in step 1 to reduce the dimension of the feature data and reduce noise; Step 2.1: Use a hash function to map the preprocessed feature values ​​to the hash function space; Step 2.2: Filter out important features based on the preset threshold and reduce the influence of irrelevant features; Step 3: Use the FPN-Transformer model to perform in-depth analysis and feature extraction on the compressed feature data; Step 4: The feature data obtained in step 3 is further fused and classified through a multi-layer regression feature extraction model; Step 5: Based on the output results of the multi-layer regression feature extraction model, determine whether there is malicious code in the code file, and obtain the malicious code family to which the malicious code belongs.

[0008] Preferably, the code of the code file or code assembly to be classified is in binary or script format.

[0009] Preferably, in step 1, the natural language processing model is a CodeBERT model.

[0010] Preferably, the FPN-Transformer model specifically includes multiple average pooling layers, M encoders and M decoders, where M is the number of encoders, the encoder includes an input embedding layer, a multi-head attention unit, a normalization layer, a feedforward neural network and a normalization layer connected in sequence, and the structure of the decoder is the same as that of the encoder; the multi-head attention unit and the feedforward neural network with a self-attention mechanism are used for feature conversion and enhancement.

[0011] Preferably, the multi-layer regression feature extraction model specifically includes parallel channel attention modules and spatial attention modules, linear layers and regression layers, and autocorrelation matrix classifiers. The channel attention module includes an input embedding layer, parallel average pooling layers and maximum pooling layers, and a shared multi-layer perceptron; the spatial attention module includes an input embedding layer, parallel average pooling layers and maximum pooling layers, and a convolutional layer. The channel attention module and the spatial attention module are combined with the linear layer and the regression layer to capture the multi-scale information of malicious code features. The shared multi-layer perceptron of the channel attention module is combined with the regression layer to enhance the richness and robustness of feature expression. The autocorrelation matrix classifier uses the autocorrelation matrix to evaluate and strengthen the relationship between classification features, optimizes feature combinations through autocorrelation, and improves classification accuracy and robustness.

[0012] Furthermore, in step 1, important features are obtained by screening according to a preset threshold, and the dimension size of the hash function space and the threshold for feature screening are dynamically adjusted according to the needs of the FPN-Transformer model.

[0013] The present invention also provides a malicious code classification system corresponding to the malicious code classification method, comprising: Data input module: receiving code files or code assembly as input; Data preprocessing module: preprocesses the code data obtained by the data input module, including feature extraction, data cleaning, standardization / normalization and feature selection, to ensure the quality and consistency of the input data, and outputs the preprocessed feature data to the Hash random compression module; Hash random compression module: uses the hash algorithm to randomly map and compress the preprocessed feature data and map it to the hash space; Feature selection module: It selects the feature data mapped and compressed by the hash algorithm according to the set threshold, retains the features that contribute significantly to the classification of malicious code families, and generates a compressed feature set; FPN-Transformer model module: Use the FPN-Transformer model to perform in-depth analysis and feature extraction on the feature data output by the feature selection module; Multi-layer regression feature extraction model module: Use the multi-layer regression feature extraction model to extract multi-scale feature information from the feature data output by the FPN-Transformer model, generate channel attention features and spatial attention features and fuse them, use the linear layer to perform linear transformation on the fused features, input the linearly transformed features into the regression layer, and generate the autocorrelation matrix; Classification result output module: Based on the autocorrelation matrix obtained by the multi-layer regression feature extraction model, it is determined whether there is malicious code in the code file, and the malicious code family to which the malicious code belongs is obtained for the malicious code, and the final classification result is output.

[0014] Compared with the prior art, the beneficial effects of the present invention include: 1) The present invention combines the feature pyramid network FPN and the Transformer model to construct an FPN-Transformer model, provides multi-level and multi-perspective feature data for the multi-layer regression feature extraction model, and then uses the multi-layer regression feature extraction model to integrate and fuse the features of different levels extracted by the FPN-Transformer model. Compared with the existing malicious code classification method using a single classification model, the present invention successively adopts two models, namely, firstly adopts the FPN-Transformer model to decompose and mine the input data features, and then adopts the multi-layer regression feature extraction model to perform attention weight enhancement, feature extraction, and feature fusion, and inputs the fused features into the autocorrelation matrix classifier to obtain the classification of the malicious code, thereby effectively improving the accuracy and generalization ability of the malicious code classification method, preventing the classification model from overfitting and avoiding the classification model collapse phenomenon, and improving the stability of the classification model.

[0015] 2) The present invention uses hash functions to select features from feature data before inputting into the FPN-Transformer model. Hash functions are random and can dynamically map and compress features, which enables the model to better adapt to different types of malicious code and reduces the risk of model overfitting. Traditional feature selection methods, such as those based on statistical features or information gain, are usually fixed, which means that once certain features are selected, the model will always rely on these features in subsequent training. These methods in the prior art often show deficiencies when processing dynamic and complex malicious code. The present invention combines the hash random compression method with a deep learning model, which can adaptively learn and filter key features and improve the accuracy and efficiency of malicious code classification.

[0016] 3) The present invention uses the FPN-Transformer model to perform in-depth analysis and feature extraction on malicious code feature data. Compared with traditional deep learning methods, this parallel decomposition mechanism to obtain multi-scale features is more flexible and detailed. The self-attention mechanism of Transformer enables the model to pay more attention to the relationship between features and contextual information when analyzing features. This mechanism is particularly useful in malicious code classification. Compared with deep learning models such as LSTM, the FPN-Transformer module can process features in parallel and use the self-attention mechanism to efficiently capture long-distance dependencies without the need to traverse the sequence step by step, making it more efficient and effective in handling complex malicious code classification tasks.

[0017] 4) The present invention uses a multi-layer regression feature extraction model to integrate and fuse the multi-level and multi-scale features output by the FPN-Transformer model. The multi-layer regression feature extraction model not only performs simple feature extraction, but also can extract multi-scale information from the features output by the FPN-Transformer model, and perform feature fusion through channel attention and spatial attention mechanisms; while traditional deep learning models, such as single-layer fully connected networks or single convolutional layers, can usually only capture information at a certain level or dimension of the input features. The multi-layer regression feature extraction model of the present invention can not only extract and fuse multi-scale features through multi-level regression analysis, but also deeply explore the complex relationship between features through channel attention and spatial attention mechanisms. This deep feature fusion enables the model to better capture the multi-dimensional features of malicious code, thereby achieving better results in classification tasks.

[0018] 5) The present invention utilizes the autocorrelation matrix classifier to fuse the feature data output by the parallel channel attention module and the spatial attention module, optimizes the feature structure diagram, facilitates the accurate classification of the malicious code family to which the malicious code belongs, and further enhances the recognition accuracy of the present invention for the features of different malicious code families.

[0019] 6) The model of the present invention can adaptively learn the feature representation of different data distributions, thereby more accurately identifying and classifying malicious code families, improving the accuracy and efficiency of classification, and reducing the dependence on high-quality training data, making it more efficient when processing large-scale or low-quality data sets. The method of the present invention reduces the consumption of computing resources and improves the feasibility and effect of the model in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0021] Figure 1 The figure is a data flow diagram of the malicious code classification method according to an embodiment of the present invention.

[0022] Figure 2 Schematic diagram of the Hash random compression process according to an embodiment of the present invention.

[0023] Figure 3 Schematic diagram of the structure of the FPN-Transformer model of an embodiment of the present invention.

[0024] Figure 4 Schematic diagram of a multi-layer regression feature extraction model according to an embodiment of the present invention.

[0025] Figure 5 This is a comparison chart of the classification effects of the present invention and the Transformer-CNN model. DETAILED DESCRIPTION

[0026] In order to improve the accuracy and efficiency of malicious code family classification, the embodiment of the present invention proposes a malicious code classification method and system based on Hash function and FPN-Transformer. The main implementation principle, specific implementation process and corresponding beneficial effects of the embodiment of the present invention are described in detail below in conjunction with the drawings of the specification.

[0027] like Figure 1 As shown in the figure, the specific steps of the malicious code classification method based on Hash function and FPN-Transformer include: Step 1: Extract the original malicious code file from the open source dataset PS and perform data preprocessing.

[0028] Step 1.1: Extract required features from the input data, including abstract syntax tree AST, node Node, code Code, entropy and other features.

[0029] Step 1.2: Clear the noise and irrelevant information in the data, delete null values ​​or outliers, and ensure data quality.

[0030] Step 1.3: Normalize the data to ensure comparability between different features. The normalization formula is:

[0031] In the formula is the mean, is the standard deviation, , They are the feature data before and after normalization respectively.

[0032] Step 1.4: Select features that are useful for the classification task and remove redundant features.

[0033] Step 2: Perform hash random compression on the feature data obtained in step 1 to reduce the dimension of the feature data and reduce noise, such as Figure 2 shown.

[0034] Step 2.1: Use a hash function to map the preprocessed feature values ​​to the hash function space.

[0035] Step 2.1.1: Select a suitable hash function for data preprocessing. The selected hash function has the characteristics of efficient mapping and low conflict.

[0036] Step 2.1.2: The feature data obtained in step 1 Split into multiple small pieces , use the hash function selected in step 2.1.1 to hash each small block Perform random mapping and compression, the hash function is:

[0037] In the formula h represents a hash function, i is the feature vector, i is a random vector, is a prime number, is the size of the hash space; d Indicates the size of the feature dimension.

[0038] Step 2.2: Filter out important features based on the preset threshold and reduce the impact of irrelevant features.

[0039] Step 2.2.1: Set the threshold σ based on the eigenvalue distribution and feature importance measurement; Step 2.2.2: Keep the features below the threshold σ and discard the other features. The calculation formula is:

[0040] In the formula Indicates the filtered hash feature data.

[0041] Step 3: Input the filtered features into the FPN-Transformer classification model, such as Figure 3 As shown, the FPN-Transformer model is used to perform in-depth analysis and feature extraction on the compressed feature data.

[0042] Step 3.1: Convert the sample feature data input into the FPN-Transformer classification model into an embedding vector. The dimension of the sample feature data is N×128, where N is the number of samples and the feature dimension is 128.

[0043] Step 3.2: Perform four average pooling operations of different sizes on the embedded vector to generate four sets of feature maps, where the pooling window sizes are 2, 4, 8, and 16, and the feature dimensions after pooling are N×64, N×32, N×16, and N×8, respectively.

[0044] Step 3.3: Concatenate the four groups of pooled feature maps together in the feature dimension to form a large feature patch.

[0045] Step 3.4: Input the feature patch into the encoder for processing. The number of encoders is adjusted according to the performance of the model to find the best parameters. In this embodiment, 6 encoders are used. Each encoder contains a multi-head attention mechanism unit, a feed-forward neural network, and a normalization layer.

[0046] Step 3.4.1: The multi-head attention mechanism unit calculates the correlation between input features, generates an attention weight matrix, and uses 8 attention heads to capture global information.

[0047] Step 3.4.2: Use a feedforward neural network to perform nonlinear transformation on the features output by the attention mechanism. The hidden layer dimension of the feedforward neural network used is 512.

[0048] Step 3.4.3: The normalization layer normalizes the output of each layer, and the feature representation dimension after feature generation is N×120.

[0049] Step 3.5: Input the features output by the encoder into the decoder for processing. The decoder structure is similar to the encoder, including a multi-head attention mechanism, a feedforward neural network, and a normalization layer. In this embodiment, 6 decoders are used in the same way as the encoder. The data processing process of each decoder is the same as that of the encoder in step 3.4, and the feature representation dimension after feature reconstruction is N×120.

[0050] Step 4: The features reconstructed from the encoder features in step 3 are further fused and classified through a multi-layer regression feature extraction model, such as Figure 4 shown.

[0051] Step 4.1: Use the channel attention module to extract multi-scale feature information from the feature data output by the FPN-Transformer model and generate channel attention features.

[0052] Step 4.1.1: In the channel attention module, the input feature representation is converted into an embedding vector suitable for subsequent processing through the input embedding layer.

[0053] Step 4.1.2: Use average pooling AvgPool and maximum pooling MaxPool operations to generate two sets of feature maps. The feature dimension after pooling is still N×120N.

[0054] Step 4.1.3: Input the pooled features into the shared multi-layer perceptron Shared MLP for feature transformation. The shared MLP transforms the feature dimension to N×60N.

[0055] Step 4.1.4: Fuse the transformed features through element-wise addition Sum and element-wise multiplication Multiply operations to generate channel attention features.

[0056] Step 4.2: Use the spatial attention module to extract multi-scale feature information from the feature data output by the FPN-Transformer model and generate spatial attention features.

[0057] Step 4.2.1: In the spatial attention module, the input feature representation is converted into an embedding vector using the input embedding layer.

[0058] Step 4.2.2: Use average pooling AvgPool and maximum pooling MaxPool to generate two sets of feature maps. The feature dimension after pooling is still N×120N.

[0059] Step 4.2.3: The pooled features are input into the convolution layer Conv for feature convolution operation. The feature dimension after convolution is still N×120.

[0060] Step 4.2.4: The convolved features are fused through element-wise addition Sum and element-wise multiplication Multiply operations to generate spatial attention features.

[0061] Step 4.3: Fuse the channel attention features and spatial attention features to generate the final attention feature representation.

[0062] Step 4.4: Use the linear layer to perform linear transformation on the fused features, and the output dimension is N×120.

[0063] Step 4.5: Input the linearly transformed features into the regression layer to generate the autocorrelation matrix for the final feature classification. The output dimension of the autocorrelation matrix is ​​N×𝜆, where 𝜆 is the number of labels for the classification task. The mathematical relationship of the autocorrelation matrix classifier is:

[0064] In the formula represents the initialization parameters in the label space, represents the parameters in another dimension in the label space, represents the Kronecker delta function, Label representation used to distinguish different categories, and Represents the similarity or angular relationship between two vectors in the label space in the high-dimensional space.

[0065] Step 5: Output the predicted label category and compare it with the true label category to calculate the loss value.

[0066] In the embodiment, the training of the FPN-Transformer model and the multi-layer regression feature extraction model specifically includes: 1) Generate a training sample dataset, which contains malicious code samples from actual network traffic or pre-designed ones; 2) Label the training sample data set and add a category label to each sample image. The category label indicates which malicious code family the sample belongs to. 3) The number of samples in the dataset is 1000-5000, and the balance of samples in each family is guaranteed to improve the generalization ability and accuracy of the model.

[0067] In the embodiment, the malicious code dataset PS published by White on Github is used. The dataset contains samples from multiple malicious code families, and the dataset is divided into six families: Class0 = Downloader, Class1 = Shellcode Inject, Class2 = Unicorn, Class3 = Powerfun, Class4 = SET, and Class5 = PowerShellEmpire. The CPU of the operating environment of the embodiment is Intel (R) Xeon (R) Gold 6330 CPU @ 2.00GHz, the GPU is GeForce RTX 3090, the memory is 500G, the version of the programming language Python used is 3.7, and the method in this article is implemented and tested using tools such as Pytorch and Sklearn.

[0068] The number of model iterations in the embodiment is uniformly selected as 100 times, the feature dimension of the input data of the model is 512, the hidden layer dimension is 64, the number of heads of the multi-head attention mechanism in the FPN-Transformer model is 8, the number of layers of the encoder is 1, the number of layers of the decoder is 2, the optimization algorithm is selected as the Adam algorithm, and the learning rate is set to 0.0001.

[0069] The experimental results show that the classification accuracy of the proposed method on the White PS dataset reaches 97.8%. The classification precision, recall rate and F1 value also reach a high level, and the classification accuracy of the malicious code families Downloader, ShellcodeInject, The classification accuracy of Unicorn, Powerfun, SET, and PowerShell Empire is shown in Table 1.

[0070] In addition, the present invention is compared with the current latest malicious code classification model Transformer-CNN. The comparison results are as follows: Figure 5 As shown in Figure 5 (a), it is a scatter plot of the distribution of data points of different categories in the original data set. Although the boundaries of data points of different categories in the figure are relatively clear, there is still a certain degree of confusion. Figure 5 5 (b) and 5 (d) compare the clustering effects of the Transformer-CNN model and the method of the present invention. The figure shows the effect of reducing the high-dimensional data to a two-dimensional plane. Figure 5 5 (c) and 5 (e) compare the fit between the predicted values ​​and the true labels of the Transformer-CNN model and the method of the present invention through line graphs. The results show that the predicted line of the method of the present invention is closer to the line of the true label and shows a smaller deviation, which confirms the superiority of the method of the present invention in accuracy and generalization ability.

[0071] Table 1 Classification accuracy of each malicious code family .

Claims

1. Malicious code classification method based on Hash function and FPN-Transformer, It is characterized in that Use hash functions to compress the code file data to be classified, reduce the dimension of feature data and reduce noise; Combine the feature pyramid network FPN and the Transformer model to build the FPN-Transformer model, which provides multi-level and multi-perspective feature data for the multi-layer regression feature extraction model; use the multi-layer regression feature extraction model to integrate and fuse the features of different levels extracted by the FPN-Transformer model, and output the final code classification result based on the fusion result; The malicious code family classification method comprises the following steps: Step 1: Data preprocessing: using the natural language processing model to extract preliminary feature data from the code of the code file to be classified, capturing the semantic and structural information of the code; Step 2: Perform hash random compression processing on the feature data obtained in step 1 to reduce the dimension of the feature data and reduce noise; Step 2.1: Use a hash function to map the preprocessed feature values ​​to the hash function space; Step 2.2: Filter out important features based on the preset threshold and reduce the influence of irrelevant features; Step 3: Use the FPN-Transformer model to perform in-depth analysis and feature extraction on the compressed feature data; Step 4: The feature data obtained in step 3 is further fused and classified through a multi-layer regression feature extraction model; Step 5: Based on the output results of the multi-layer regression feature extraction model, determine whether there is malicious code in the code file, and obtain the malicious code family to which the malicious code belongs.

2. The malicious code classification method according to claim 1, It is characterized in that The FPN-Transformer model specifically includes multiple average pooling layers, M encoders and M decoders, where M is the number of encoders, the encoder includes an input embedding layer, a multi-head attention unit, a normalization layer, a feedforward neural network and a normalization layer connected in sequence, and the structure of the decoder is the same as that of the encoder; Multi-head attention units and feed-forward neural networks with self-attention mechanism are used for feature transformation and enhancement.

3. The malicious code classification method according to claim 2, It is characterized in that The multi-layer regression feature extraction model specifically includes a parallel channel attention module and a spatial attention module, a linear layer and a regression layer, and an autocorrelation matrix classifier, and the channel attention module includes an input embedding layer, a parallel average pooling layer and a maximum pooling layer, and a shared multi-layer perceptron; The spatial attention module includes an input embedding layer, parallel average pooling layers and maximum pooling layers, and a convolutional layer; The channel attention module and spatial attention module are combined with the linear layer and regression layer to capture the multi-scale information of malicious code features. The shared multi-layer perceptron of the channel attention module is combined with the regression layer to enhance the richness and robustness of feature expression. The autocorrelation matrix classifier uses the autocorrelation matrix to evaluate and strengthen the relationship between classification features, optimizes the feature combination through autocorrelation, and improves the accuracy and robustness of classification.

4. The malicious code classification method according to claim 3, It is characterized in that Step 1 specifically includes the following sub-steps: Step 1.1: Use the CodeBERT model to extract feature data from the code file, including abstract syntax tree AST, node Node, code Code, and entropy; Step 1.2: Clear the noise and irrelevant information in the feature data, and delete null values ​​or outliers; Step 1.3: Standardize or normalize the feature data to ensure comparability between different features; the formula used for normalization is as follows, where is the mean, is the standard deviation: In the formula is the mean, is the standard deviation, , They are the feature data before and after normalization processing respectively; Step 1.4: Select feature data that is useful for the classification task and remove redundant feature data.

5. The malicious code classification method according to claim 4, It is characterized in that The step 2.1 specifically includes the following sub-steps: Step 2.1.1: Select a suitable hash function for data preprocessing. The selected hash function has the characteristics of efficient mapping and low conflict. Step 2.1.2: The feature data obtained in step 1 Split into multiple small pieces , use the hash function selected in step 2.1.1 to hash each small block Perform random mapping and compression, the hash function is: In the formula h represents a hash function, i is the feature vector, i is a random vector, is a prime number, is the size of the hash space; d Indicates the size of the feature dimension.

6. The malicious code classification method according to claim 5, It is characterized in that The step 2.2 specifically includes the following sub-steps: Step 2.2.1: Set the threshold σ based on the eigenvalue distribution and feature importance measurement; Step 2.2.2: Keep the features below the threshold σ and discard the other features. The calculation formula is: In the formula Indicates the filtered hash feature data.

7. The malicious code classification method according to claim 6, It is characterized in that Step 3 specifically includes the following sub-steps: Step 3.1: Convert the input sample feature data into an embedding vector; Step 3.2: Perform average pooling operations of different sizes on the embedded vectors to generate multiple sets of feature map data; Step 3.3: Concatenate the multiple sets of feature mapping data obtained in step 3.2 together in the feature dimension to form a feature patch; Step 3.4: Input the feature patch obtained in step 3.3 into the encoder for processing; Step 3.4.1: Use the multi-head attention mechanism unit to calculate the correlation between input features and generate an attention weight matrix; Step 3.4.2: Use the feedforward neural network to perform nonlinear transformation on the features output by the multi-head attention mechanism unit; Step 3.4.3: Normalize the feature data output by the feedforward neural network; Step 3.5: Input the feature data output by the encoder into the decoder for processing. The data processing process of the decoder is the same as step 3.4, and multi-level and multi-view feature data is obtained.

8. The malicious code classification method according to claim 7, It is characterized in that In step 4, the FPN-Transformer model is used to perform in-depth analysis and feature extraction on the compressed feature data, specifically including: 1) Use the channel attention module to extract multi-scale feature information from the feature data output by the FPN-Transformer model and generate channel attention features; 1.1) Convert the input feature representation into an embedding vector through the input embedding layer; 1.2) Use average pooling AvgPool and maximum pooling MaxPool operations to generate two sets of feature maps; 1.3) Input the pooled features into the shared multi-layer perceptron for feature transformation; 1.4) The features transformed by the shared multilayer perceptron are fused through element-by-element addition and element-by-element multiplication operations to generate channel attention features; 2) Use the spatial attention module to extract multi-scale feature information from the feature data output by the FPN-Transformer model and generate spatial attention features; 2.1) Use the input embedding layer to convert the input feature representation into an embedding vector; 2.2) Use average pooling AvgPool and maximum pooling MaxPool operations to generate two sets of feature maps; 2.3) Input the pooled features into the convolution layer Conv for feature convolution operation; 2.4) The convolutional features are fused through element-by-element addition and element-by-element multiplication operations to generate spatial attention features; 3) Fuse the channel attention features and spatial attention features to generate the final attention feature representation; use the linear layer to linearly transform the fused features; input the linearly transformed features into the regression layer to generate the autocorrelation matrix.

9. The malicious code classification method according to claim 8, It is characterized in that The mathematical relationship of the autocorrelation matrix classifier is: In the formula represents the initialization parameters in the label space, represents the parameters in another dimension in the label space, represents the Kronecker delta function, Label representation used to distinguish different categories, and Represents the similarity or angular relationship between two vectors in the label space in the high-dimensional space.

10. A system for the malicious code classification method according to any one of claims 1 to 9, It is characterized in that include: Data input module: receiving code files or code assembly as input; Data preprocessing module: preprocess the code data obtained by the data input module. Including feature extraction, data cleaning, standardization / normalization and feature selection to ensure the quality and consistency of input data, and output the pre-processed feature data to the Hash random compression module; Hash random compression module: uses the hash algorithm to randomly map and compress the preprocessed feature data and map it to the hash space; Feature selection module: It selects the feature data mapped and compressed by the hash algorithm according to the set threshold, retains the features that contribute significantly to the classification of malicious code families, and generates a compressed feature set; FPN-Transformer model module: Use the FPN-Transformer model to perform in-depth analysis and feature extraction on the feature data output by the feature selection module; Multi-layer regression feature extraction model module: Use the multi-layer regression feature extraction model to extract multi-scale feature information from the feature data output by the FPN-Transformer model, generate channel attention features and spatial attention features and fuse them, use the linear layer to perform linear transformation on the fused features, input the linearly transformed features into the regression layer, and generate the autocorrelation matrix; Classification result output module: Based on the autocorrelation matrix obtained by the multi-layer regression feature extraction model, it is determined whether there is malicious code in the code file, and the malicious code family to which the malicious code belongs is obtained for the malicious code, and the final classification result is output.

Images