Malicious code detection method based on software gene and improved Siamese network

Abstract

The invention relates to a malicious code detection method based on software genes and an improved Siamese network, which comprises the following steps of: preprocessing data, performing static analysis and dynamic analysis on a code file to be detected, and extracting basic characteristics; converting the basic features into gene segments, mapping the gene segments into gene expression, and constructing a gene sequence of the code; performing similarity comparison on the extracted gene sequence and a known malicious code gene pool by utilizing an improved Siamese network to obtain a similarity calculation result; according to a similarity calculation result, judging whether the code file contains malicious gene characteristics or not, and if the malicious code is detected, further determining a malicious code family to which the malicious code belongs; and according to a detection result, updating and optimizing a malicious code gene pool, so that the malicious code gene pool covers the latest malicious code sample and variant features. According to the method, the malicious code gene features are combined with the AI model, so that the effect of the malicious code detection task is remarkably improved.

Description

Technical Field

[0001] The invention belongs to the field of network security, and in particular relates to a malicious code detection method based on software genes and improved Siamese networks. Background Art

[0002] Malicious code detection is usually performed by analyzing the characteristics and behavior patterns of malware. These detection methods are dedicated to identifying and responding to the attack strategies and activity patterns of malware in different environments. Although many malicious codes exhibit similar attack characteristics, their behaviors are diverse. Malicious code is likely to show specific attack intentions such as data theft, system destruction, or other security threats. Therefore, accurate identification and detection of these malicious code characteristics is crucial to improving network security protection.

[0003] With the rapid growth of the number of malicious codes, although the early rule-based and signature-based methods have made some progress, they are faced with the problems of slow pattern updates and high false alarm rates. Existing feature library detection methods often face the following problems when dealing with complex and changeable malicious codes: slow pattern updates, new malicious codes appear quickly, feature library updates are often delayed, and new threats cannot be responded to in a timely manner; high false alarm rates, fixed rules and signature matching are prone to false alarms, especially when dealing with variant malicious codes; insufficient feature extraction, traditional methods rely on predefined static features, and cannot fully capture the dynamic behavior characteristics of malicious codes; high resource consumption, when processing large-scale data sets, feature library matching consumes a lot of computing resources, affecting detection efficiency.

[0004] The present invention aims to overcome these deficiencies of the prior art by introducing software gene technology, extracting the unique gene features of malicious code and building an efficient gene library system to achieve accurate detection and classification of malicious code. Summary of the invention

[0005] The technical problem of the present invention is that existing malicious code detection methods have limitations in many aspects. First, these methods usually rely on high-quality annotated data, which is time-consuming and laborious to obtain. In addition, existing methods are complex and prone to inaccurate features in feature extraction, resulting in high resource consumption and low processing efficiency. Moreover, these methods often have insufficient detection accuracy when dealing with the ever-changing and complex and diverse malicious code features, and cannot effectively deal with the threats of new and variant malicious codes.

[0006] The purpose of the present invention is to provide a malicious code detection method based on software genes and improved Siamese networks to address the above problems, reduce the dependence on high-quality data by improving data preprocessing and feature extraction mechanisms, and optimize feature expression and detection efficiency by building and maintaining an efficient malicious code gene library, thereby improving the accuracy and practicality of detection.

[0007] In order to achieve the above object, the technical solution of the present invention is: The malicious code detection method based on software genes and improved Siamese network includes the following steps: Step 1: Data preprocessing: static and dynamic analysis of the code files to be tested to extract basic features; Step 2: Convert the basic features obtained in step 1 into gene fragments and map them to gene expressions to construct the gene sequence of the code; Step 3: Using the improved Siamese network, the gene sequence extracted in step 2 is compared with the known malicious code gene library to obtain the similarity calculation result; Step 4: Based on the similarity calculation results, determine whether the code file contains malicious gene features. If so, further determine the malicious code family it belongs to and output the detection and classification results; Step 5: Gene library update and optimization: According to the detection results, update and optimize the malicious code gene library so that the malicious code gene library covers the latest malicious code samples and variant features.

[0008] Preferably, the improved Siamese network includes an encoder, an adaptive weighting module and a decoder, the encoder includes a first convolution layer, a maximum pooling layer, a second convolution layer, an average pooling layer, a third convolution layer and a flattening layer; the decoder includes 3 fully connected layers; the adaptive weighting module adopts an adaptive weighting algorithm.

[0009] Furthermore, the step 1 specifically includes the following sub-steps: Step 1.1: Use the static analysis tool IDA Pro to parse the code structure, API call sequence and string constants of the code file to be tested to obtain static features; Step 1.2: Use the dynamic analysis platform Cuckoo Sandbox to analyze the runtime behavior and system call sequence of the code file to be tested to obtain dynamic features; Step 1.3: Clear the noise and irrelevant information in the data, delete null values ​​or outliers, and ensure the quality of feature data; Step 1.4: Standardize the extracted basic features to make different features comparable.

[0010] Furthermore, the step 2 specifically includes the following sub-steps: Step 2.1: Perform feature segmentation processing on the basic features extracted from static analysis and dynamic analysis, and divide the basic features into independent gene segments according to the predefined gene segment rules; Step 2.2: Map each gene fragment to gene expression, that is, convert the gene fragment into a feature vector; Step 2.3: All gene fragments are combined into a complete gene sequence. By splicing or arranging the feature vectors of multiple gene fragments, a complete gene sequence of the code is constructed, so that it can be effectively compared with the existing malicious code genes in the malicious code gene library for similarity.

[0011] Furthermore, the step 3 specifically includes the following sub-steps: Step 3.1: Compare the gene feature vector of the sample to be detected with all the gene features in the malicious code gene library; use the improved Siamese network to calculate the similarity between the sample and each gene feature in the malicious code gene library. The similarity calculation formula is: ; In the formula, represents the similarity function, , They represent the gene feature vectors in the sample to be detected and the malicious code gene library respectively. is the feature extraction function of the improved Siamese network, represents the weight matrix, is the activation function; Step 3.2: Combine the similarity scores of the output of the statistical analysis and the improved Siamese network, and dynamically set the similarity threshold according to the similarity distribution of the gene features in the malicious code gene library. The calculation formula of the similarity threshold is: ; In the formula, is the similarity threshold, and They represent the mean and standard deviation of the similarity scores in the malicious code gene library; , They are adjustment coefficients, used to control the impact of standard deviation and feature deviation on the threshold; represents the weight of the i-th feature, represents the eigenvalue output by the improved Siamese network, represents the expected value of the feature; n represents the number of features; Step 3.3: Screen out gene features with higher similarity; according to the set similarity threshold , the gene features whose similarity scores output by the improved Siamese network exceed the threshold are screened out, and it is judged that these gene features have a high similarity with the sample to be tested; Step 3.4: Evaluate the relationship between gene features. Further analyze the similar gene features selected in step 3.3. Use an adaptive weighting algorithm to dynamically adjust the weights of different features to ensure that the influence weights of each feature are reasonably distributed during the evaluation process. Finally, accurate similarity detection results are obtained. The calculation formula of the adaptive weighting algorithm is:

[0012] In the formula, Indicates i The weight of the feature, is the similarity value of the corresponding feature, , They are all weight adjustment coefficients, which are used to control the distribution of weights.

[0013] Furthermore, step 4 specifically includes the following sub-steps: Step 4.1: According to the similarity analysis result of the improved Siamese network, if the similarity between the gene feature of the code file to be detected and one or more gene features in the malicious code gene library exceeds a threshold, it is determined that the code file contains malicious code; Step 4.2: For the code files determined to contain malicious code, the possible family affiliation is determined by analyzing the similarity between the malicious code and the gene features of different families in the malicious code gene library; the family with the highest similarity is selected as the family affiliation of the malicious code; Step 4.3: Generate a detection report; based on the similarity analysis results, generate a detailed detection report, including whether the code sample is malicious code, its possible family affiliation, and similarity analysis details.

[0014] Furthermore, step 5 specifically includes the following sub-steps: Step 5.1: For the malicious code samples whose family is determined to belong to, extract their genetic features again to ensure the accuracy and completeness of the features; Step 5.2: Add the gene features of the new malicious code sample to the corresponding malicious code family gene library; Step 5.3: De-redundancy processing is performed on the updated malicious code gene library, and highly similar gene features are merged to avoid the gene library being too long and repeated; Step 5.4: Regularly maintain and update the malicious code gene library based on the introduction of new malicious code samples and changes in existing malicious code samples.

[0015] The system of the above-mentioned malicious code detection method includes: Gene extraction module: performs static and dynamic analysis on the code file data to be tested, extracts representative gene features, and provides clean data input for other modules; Gene library management module: builds and maintains the gene database of known malware families, and optimizes the gene library structure through redundancy removal and diversity maintenance strategies; Siamese network similarity calculation module: uses the improved Siamese network to calculate the similarity between the extracted gene feature vector and the gene feature vector in the gene library; Detection decision module: Based on the similarity score output by the improved Siamese network, it is compared with the set threshold to make a detection decision; Gene bank update module: dynamically updates and maintains the gene bank according to the introduction of new samples and changes in existing samples to ensure the real-time and effectiveness of the gene bank.

[0016] Compared with the prior art, the beneficial effects of the present invention include: 1) The present invention adopts a malicious code detection method based on software genes, which can extract representative gene features from the input code. These gene features can effectively capture the core behavior and characteristic patterns of malicious code. Compared with traditional methods based on feature signatures or behavioral analysis, the present invention can more accurately identify and classify malicious code families. Gene feature extraction and similarity detection algorithms can adaptively extract key information in large-scale data sets, thereby improving the accuracy and efficiency of malicious code detection and avoiding the limitations of traditional methods in dealing with new or variant malware.

[0017] 2) The present invention uses software gene libraries to detect unknown codes and compares their features with genes in known malicious code gene libraries. This method can dynamically and flexibly adapt to the variant features of new malicious codes. Compared with the fixed feature selection method in the prior art, the present invention can adaptively update and optimize the gene library to ensure that the detection model is always in the latest state, thereby improving the detection capability of unknown malware and enhancing the robustness and response capability of the system.

[0018] 3) The gene similarity detection module of the present invention can quickly identify the similarity between code fragments and known malicious code genes in a short time through an improved Siamese network and an adaptive weighted algorithm, thereby achieving fast and accurate detection. This method can achieve efficient detection with low computing resource consumption, and is particularly suitable for real-time malicious code monitoring and protection in large-scale network environments, significantly improving the detection speed and response capability of the system.

[0019] 4) By introducing an improved Siamese network for multi-dimensional gene feature analysis, the present invention can capture the complex behavior patterns and potential features of malicious code. Compared with the traditional detection method based on a single feature, the present invention provides richer and deeper feature data analysis capabilities through an adaptive weighted algorithm. This multi-dimensional gene analysis method enables the system to more comprehensively understand and identify the diverse features of malicious code, improving the accuracy and generalization ability of malicious code classification.

[0020] 5) The present invention can effectively classify malicious code families, and enhances the ability to identify and classify malicious code families through in-depth analysis of the genetic characteristics of different families using the improved Siamese network. The detection system based on software genes can make classification decisions based on the characteristics of different families, further improving the detection accuracy and reliability of complex malware, and helping to improve the overall level of network security protection.

[0021] 6) The detection system of the present invention can adaptively learn and adjust the gene feature library through Siamese network and adaptive weighting algorithm, continuously optimize and update over time, and maintain efficient detection capabilities when dealing with evolving malicious code and malicious code variants. Compared with the traditional method that relies on fixed training data sets, the present invention significantly reduces the dependence on high-quality training data, making the system more flexible and operable in practical applications, especially more efficient and accurate when dealing with massive data and low-quality data. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0023] Figure 1 Schematic diagram of a malicious code detection system according to an embodiment of the present invention.

[0024] Figure 2 Schematic diagram of the gene library construction process according to an embodiment of the present invention.

[0025] Figure 3 The figure is a schematic diagram of the malicious code detection process according to an embodiment of the present invention.

[0026] Figure 4 The diagram is a schematic diagram of an improved Siamese network structure according to an embodiment of the present invention.

[0027] Figure 5 The figure is a comparison chart of the detection effect of the method of the present invention and different anti-virus engines. DETAILED DESCRIPTION

[0028] In order to improve the accuracy and efficiency of malicious code detection, the embodiment of the present invention proposes a malicious code detection method and system based on software gene technology and improved Siamese network. The main implementation principle, specific implementation process and corresponding beneficial effects of the embodiment of the present invention are described in detail below in conjunction with the drawings of the specification.

[0029] The data set used in this embodiment contains samples of multiple malicious code families, and the data set is divided into six families: Downloader, Shellcode Inject, Unicorn, Powerfun, SET, and PowerShell Empire. The CPU of the operating environment of the embodiment is Intel(R) Xeon(R) Gold 6330 CPU @ 2.00GHz, the GPU is GeForce RTX3090, the memory is 500G, the version of the programming language Python used is 3.7, and tools such as Pytorch and Sklearn are used to implement and test the method in this article.

[0030] like Figure 4 As shown in the figure, the improved Siamese network introduces an adaptive weighting module, so that the input feature vector is dynamically weighted and adjusted before similarity calculation, thereby enhancing the focus on important features. The encoder of the improved Siamese network uses multiple layers of convolution to gradually extract the high-dimensional features of the sample, and downsamples the feature map through the maximum pooling and average pooling layers, and then uses the flattening layer Flatten to flatten the three-dimensional feature map into a one-dimensional vector. The flattened feature vector is input to the adaptive weighting module, which generates weights of the same dimension as the feature vector and uses these weights to dynamically weight the features, thereby enhancing the influence of key features in similarity calculation. In the similarity calculation part, the cosine similarity is used to measure the similarity of the two weighted feature vectors, and the similarity score between the two samples is calculated. In the last part of the network model, the similarity score passes through several layers of fully connected decoders, gradually reduces the dimension, and finally outputs the similarity score for classification.

[0031] The malicious code detection method based on software gene and improved Siamese network of the embodiment includes the following steps: Step 1: Get the original malicious code files from the open source dataset and extract static and dynamic features from the samples.

[0032] Step 1.1: Use the static analysis tool IDA Pro to analyze static features such as code structure, API call sequence, and string constants; Step 1.2: Use the dynamic analysis platform Cuckoo Sandbox to monitor the sample’s runtime behavior and system call sequence and other dynamic features; Step 1.3: Remove noise and irrelevant information in the data, delete null values ​​or outliers, and ensure the quality of feature data. Through this process, the noise that affects feature expression is removed and the accuracy of gene features is improved; Step 1.4: Standardize the extracted gene features to ensure the comparability between different features. Through standardization, ensure that the gene feature vectors have the same scale in different dimensions; Step 1.5: Select features that are useful for malicious code detection and classification tasks and remove redundant features. Through feature selection, retain the gene features that contribute significantly to detection and classification, and generate an optimized gene feature vector.

[0033] Step 2: Manage and classify the gene feature vectors extracted and optimized in step 1. First, preliminarily classify the gene feature vectors of all malicious code samples and divide them into multiple initial categories based on the similarity of gene features. The construction process of the gene library is shown in Figure 2. The gene processing in the gene library is the same as that of the sample.

[0034] Step 2.1: Perform feature segmentation processing on the basic features extracted from static analysis and dynamic analysis, and divide the basic features into independent gene segments according to the predefined gene segment rules; Step 2.2: Map each gene fragment to gene expression, that is, convert the gene fragment into a feature vector; Step 2.3: All gene fragments are combined into a complete gene sequence. By splicing or arranging the feature vectors of multiple gene fragments, a complete gene sequence of the code is constructed, so that it can be effectively compared with the existing malicious code genes in the malicious code gene library for similarity.

[0035] Step 3: Obtain the gene feature vector of the sample to be tested. Take the gene feature vector extracted and optimized in step 2 as input and prepare to compare it with the gene features in the gene library to calculate the similarity.

[0036] Step 3.1: Compare the gene feature vector of the sample to be tested with all the gene features in the gene library. The improved Siamese network is used to calculate the similarity between the sample and each gene feature in the gene library. The detection process of the improved Siamese network is shown in Figure 3. The input of the network model is two gene feature vectors, which represent the sample to be tested and a gene feature vector in the gene library respectively. The similarity score is generated through network calculation. The similarity calculation formula of the improved Siamese network is:

[0037] In the formula, and Represent the gene feature vectors in the sample to be tested and the gene library respectively, is the feature extraction function of the network, is the weight matrix obtained through training, is the activation function, which is used to output the similarity score.

[0038] Step 3.2: By combining statistical analysis and the improved Siamese network output score, the similarity threshold is dynamically set according to the similarity distribution of gene features in the gene library for subsequent similarity screening. The setting of this threshold not only considers the mean and standard deviation of the similarity, but also introduces the correction of feature weighting. The formula is as follows: ; In the formula, is the similarity threshold, and They represent the mean and standard deviation of the similarity scores in the malicious code gene library; , They are adjustment coefficients, used to control the impact of standard deviation and feature deviation on the threshold; represents the weight of the i-th feature, represents the eigenvalue output by the improved Siamese network, represents the expected value of the feature; n represents the number of features; Step 3.3: Screen out gene features with high similarity and select them according to the set threshold , the gene features whose similarity scores output by the improved Siamese network exceed the threshold are screened out, and it is considered that these gene features have a high similarity with the sample to be tested; Step 3.4: Evaluate the relationship between gene features, and further analyze the selected similar gene features. The improved Siamese network structure is shown in Figure 4. The weights of different features are dynamically adjusted in combination with the adaptive weighting algorithm to ensure that the influence weights of each feature are reasonably distributed during the evaluation process, and finally obtain accurate similarity detection results. The adaptive weighting formula is as follows:

[0039] In the formula, represents the weight of the i-th feature, is the similarity value of the corresponding feature, , They are all weight adjustment coefficients, which are used to control the distribution of weights.

[0040] Step 4: Comprehensively analyze the similarity results obtained in step 3. Collect all gene features whose similarity with the sample to be tested exceeds the set threshold for further comprehensive analysis.

[0041] Step 4.1: According to the similarity analysis result of the improved Siamese network, if the similarity between the gene feature of the code file to be detected and one or more gene features in the malicious code gene library exceeds a threshold, it is determined that the code file contains malicious code; Step 4.2: For the code files determined to contain malicious code, the possible family affiliation is determined by analyzing the similarity between the malicious code and the gene features of different families in the malicious code gene library; the family with the highest similarity is selected as the family affiliation of the malicious code; Step 4.3: Generate a detection report; based on the similarity analysis results, generate a detailed detection report, including whether the code sample is malicious code, its possible family affiliation, and similarity analysis details.

[0042] Step 5: Gene library update and optimization: According to the detection results, update and optimize the malicious code gene library so that the malicious code gene library covers the latest malicious code samples and variant features.

[0043] Step 5.1: For the malicious code samples whose family is determined to belong to, extract their genetic features again to ensure the accuracy and completeness of the features; Step 5.2: Add the gene features of the new malicious code sample to the corresponding malicious code family gene library; Step 5.3: De-redundancy processing is performed on the updated malicious code gene library, and highly similar gene features are merged to avoid the gene library being too long and repeated; Step 5.4: Regularly maintain and update the malicious code gene library based on the introduction of new malicious code samples and changes in existing malicious code samples; and dynamically optimize the structure and feature distribution of the gene library based on the latest threat intelligence to ensure that the gene library always covers the latest malicious code and its variants.

[0044] In the embodiment, the method of the present invention is compared with several different anti-virus engines, and the comparison results are as follows: Figure 5 As shown, Figure 5 (i) is a scatter plot of the distribution of different categories of data in the original data set. Although the boundaries of different categories of data points in the figure are relatively clear, there is still a certain degree of confusion. Figure 5 (a), (c), (e) and (g) are the clustering effect diagrams of different detection systems after classifying the samples into families. Figure 5 The figure shows the result of mapping high-dimensional features to two-dimensional space through the dimension reduction algorithm t-SNE. Points of different colors represent different malware families. Figure 5 The clustering effect shown in (g) in the two-dimensional plane is more concentrated and the class interval is more obvious, indicating that the method of the present invention is more discriminative in malware family classification.

[0045] contrast Figure 5 (b), (d), (f), and (h) compare the detection accuracy of different detection systems, and the horizontal axis is the true label. S i , the vertical axis is the predicted value detected by different systems The orange solid line represents the fitted line between the predicted value and the true value. , while the red dotted line represents the prediction line under ideal conditions, where k It represents the slope between the predicted value and the true value. b The closer the slope 𝑘 is to 1, the closer the intercept 𝑏 is to 0, indicating that the detection result is more accurate. The comparison results show that the method of the present invention has a higher accuracy and shows a smaller deviation, which confirms the superiority of the present invention in accuracy and detection ability.

[0046] The present invention is compared with other anti-virus engines in terms of key performance indicators. The comparison results are shown in Table 1. From the data in the table, it can be seen that the present invention has achieved a relatively high level in all indicators.

[0047] Table 1 Comparison results of the detection of this system and some anti-virus engines

Claims

1. A malicious code detection method based on software genes and improved Siamese network, characterized in that: Malicious code detection is performed by extracting the genetic features of the code to capture the behavioral and structural features of the code; feature comparison is performed using the software gene library to identify similarities with known malicious code; multi-dimensional genetic feature data is generated based on the basic features extracted from the code file to be detected, and then the improved Siamese network is used to perform comprehensive analysis and fusion of the genetic feature data, and the final malicious code detection and classification results are obtained based on the analysis results; The malicious code detection method comprises the following steps: Step 1: Data preprocessing: static and dynamic analysis of the code files to be tested to extract basic features; Step 2: Convert the basic features obtained in step 1 into gene fragments and map them to gene expressions to construct the gene sequence of the code; Step 3: Using the improved Siamese network, the gene sequence extracted in step 2 is compared with the known malicious code gene library to obtain the similarity calculation result; Step 4: Based on the similarity calculation results, determine whether the code file contains malicious gene features. If so, further determine the malicious code family it belongs to and output the detection and classification results.

2. The malicious code detection method according to claim 1, characterized in that: It also includes step 5: updating and optimizing the gene library, updating and optimizing the malicious code gene library according to the detection results, so that the malicious code gene library covers the latest malicious code samples and variant features.

3. The malicious code detection method according to claim 1 or 2, characterized in that: The improved Siamese network includes an encoder, an adaptive weighting module and a decoder, wherein the encoder includes a first convolutional layer, a maximum pooling layer, a second convolutional layer, an average pooling layer, a third convolutional layer and a flattening layer; the decoder includes three fully connected layers; and the adaptive weighting module includes an adaptive weighting algorithm.

4. The malicious code detection method according to claim 3, characterized in that: The step 1 specifically includes the following sub-steps: Step 1.1: Use the static analysis tool IDA Pro to parse the code structure, API call sequence and string constants of the code file to be tested to obtain static features; Step 1.2: Use the dynamic analysis platform to analyze the runtime behavior and system call sequence of the code file to be detected to obtain dynamic features; Step 1.3: Clear the noise and irrelevant information in the data, delete null values ​​or outliers, and ensure the quality of feature data; Step 1.4: Standardize the extracted basic features to make different features comparable.

5. The malicious code detection method according to claim 4, characterized in that: The step 2 specifically includes the following sub-steps: Step 2.1: Perform feature segmentation processing on the basic features extracted from static analysis and dynamic analysis, and divide the basic features into independent gene segments according to the predefined gene segment rules; Step 2.2: Map each gene fragment to gene expression and convert it into a feature vector; Step 2.3: All gene fragments are combined into a complete gene sequence. By splicing or arranging the feature vectors of multiple gene fragments, a complete gene sequence of the code is constructed so that it can be compared with the existing malicious code genes in the malicious code gene library for similarity.

6. The malicious code detection method according to claim 5, characterized in that: The step 3 specifically includes the following sub-steps: Step 3.1: Compare the gene feature vector of the sample to be detected with all the gene features in the malicious code gene library; use the improved Siamese network to calculate the similarity between the sample and each gene feature in the malicious code gene library. The similarity calculation formula is: ； In the formula, represents the similarity function, , They represent the gene feature vectors in the sample to be detected and the malicious code gene library respectively. is the feature extraction function of the improved Siamese network, represents the weight matrix, is the activation function; Step 3.2: Combine the similarity scores of the output of the statistical analysis and the improved Siamese network, and dynamically set the similarity threshold according to the similarity distribution of the gene features in the malicious code gene library. The calculation formula of the similarity threshold is: ； In the formula, is the similarity threshold, and They represent the mean and standard deviation of the similarity scores in the malicious code gene library; , They are adjustment coefficients, used to control the impact of standard deviation and feature deviation on the threshold; represents the weight of the i-th feature, represents the eigenvalue output by the improved Siamese network, represents the expected value of the feature; n represents the number of features; Step 3.3: Screen out gene features with higher similarity; according to the set similarity threshold , the gene features whose similarity scores output by the improved Siamese network exceed the threshold are screened out, and it is judged that these gene features have a high similarity with the sample to be tested; Step 3.4: Evaluate the relationship between gene features, further analyze the similar gene features screened out in step 3.3, and use an adaptive weighting algorithm to dynamically adjust the weights of different features to ensure that the influence weights of each feature are reasonably distributed during the evaluation process, and finally obtain accurate similarity detection results.

7. The malicious code detection method according to claim 6, characterized in that: In step 3.4, the calculation formula of the adaptive weighting algorithm is: In the formula, represents the weight of the i-th feature, is the similarity value of the corresponding feature, , They are all weight adjustment coefficients, which are used to control the distribution of weights.

8. The malicious code detection method according to claim 6 or 7, characterized in that: Step 4 specifically includes the following sub-steps: Step 4.1: According to the similarity analysis result of the improved Siamese network, if the similarity between the gene feature of the code file to be detected and one or more gene features in the malicious code gene library exceeds a threshold, it is determined that the code file contains malicious code; Step 4.2: For the code files determined to contain malicious code, the possible family affiliation is determined by analyzing the similarity between the malicious code and the gene features of different families in the malicious code gene library; the family with the highest similarity is selected as the family affiliation of the malicious code; Step 4.3: Generate a detailed detection report based on the similarity analysis results.

9. The malicious code detection method according to claim 8, characterized in that: Step 5 specifically includes the following sub-steps: Step 5.1: Extract the gene features of the new sample and add it to the corresponding malicious code family gene library, marking it as a new sample; Step 5.2: De-redundancy processing is performed on the updated malicious code gene library, and highly similar gene features are merged to avoid the gene library being too long and repeated; Step 5.3: Regularly maintain and update the malicious code gene library based on the introduction of new malicious code samples and changes in existing malicious code samples.

10. The system of the malicious code detection method according to claim 1, 2, 4, 5, 6, 7 or 9, characterized in that: include: Gene extraction module: performs static and dynamic analysis on the code file data to be tested, extracts representative gene features, and provides clean data input for other modules; Gene library management module: builds and maintains the gene database of known malware families, and optimizes the gene library structure through redundancy removal and diversity maintenance strategies; Siamese network similarity calculation module: uses the improved Siamese network to calculate the similarity between the extracted gene feature vector and the gene feature vector in the gene library; Detection decision module: The detection decision is made by comparing the similarity score output by the improved Siamese network with the set threshold; Gene bank update module: dynamically updates and maintains the gene bank based on the introduction of new samples and changes in existing samples to ensure the real-time and effectiveness of the gene bank.

Images