A malicious code family classification method fusing efficient-net and 1d-cnn

Abstract

In recent years, the number of malicious codes is increasing, and the problem of tracing the source of malicious codes is increasingly prominent. At present, the mainstream method of classifying malicious codes by converting malicious codes into pictures and then using image classification needs to crop and transform the malicious codes, thereby converting the malicious codes into two-dimensional images. This method will lose part of the information of the malicious codes as one-dimensional data itself, and a forcibly set image width may cause the semantic truncation problem of the malicious codes themselves. In view of the above problems, the present application proposes a malicious code classification model which fuses efficient-net and 1d-cnn, converts the binary files of the malicious codes into one-dimensional vectors and images respectively, inputs the two networks respectively, and performs pyramid fusion on the feature maps. This method not only saves the texture features of the malicious codes, but also saves the one-dimensional features of the malicious codes themselves, thereby showing good performance on the dataset of 38 malicious code families and Malimg crawled, indicating that the proposed malicious code family classification method has higher reliability.

Description

Technical Field

[0001] This invention belongs to the field of information content security, and in particular relates to a classification method for malicious code families. Background Technology

[0002] Malware is a malicious program that intentionally performs destructive functions. Malware programs are categorized into many types based on their behavior and execution process, such as worms, viruses, Trojans, rootkits, backdoors, spyware, logic bombs, adware, and ransomware. Attacking computer systems aims to damage computer resources, gain economic benefits, steal private and confidential data, consume computing resources, and render the system unusable, among other things. There is a never-ending arms race between malware writers and security personnel. On one hand, security personnel are constantly seeking new methods to improve malware detection capabilities; on the other hand, malware writers are constantly improving the obfuscation capabilities of their code to try and evade detection. According to a report by Rising, the number of malware programs has been increasing in recent years. Therefore, researchers are beginning to reconsider the importance of cybersecurity.

[0003] Early malware detection methods were signature-based, which pre-defined signature features of malware based on expert experience. Then, for an unknown piece of software, a scan was used to detect whether it contained the signature set by the expert.

[0004] However, this method is vulnerable to attacks from malicious code distortion techniques such as obfuscation and encryption. Therefore, researchers have developed heuristic detection methods to overcome these shortcomings. With the continuous development of deep learning technology, more and more research is focusing on using deep learning to detect malicious code. Cybersecurity experts generally believe that AI-powered anti-malware tools can help detect new types of malware attacks and improve scanning engines. Deep learning is replicating its success in other areas in the field of malware detection.

[0005] To better understand the motivations behind malware and develop more effective countermeasures, researchers have categorized malware into different families, leading to a study on malware family classification. The research shows that the vast majority of new malware variants differ from known malware by less than 2% in code, a crucial basis for malware classification.

[0006] Current malware classification can be mainly divided into two steps: feature extraction and classification. For feature extraction, there are three main methods: static feature extraction, dynamic feature extraction, and hybrid feature extraction. For classification methods, they are mainly divided into two categories: machine learning methods and deep learning methods. Many existing studies first extract bytecode, assembly code, file structure, or dynamic behavior features of malware, and then use machine learning algorithms for classification. However, static feature extraction from malicious disassembled code often encounters obfuscation attacks. In this case, dynamic analysis can be used directly to analyze the behavior of malware. However, dynamic analysis can usually only analyze the execution behavior of specific paths and cannot traverse all paths. Furthermore, dynamic analysis is very resource-intensive.

[0007] Methods relying on manual feature extraction are susceptible to obfuscation attacks and resource limitations, and are highly dependent on the effectiveness of manually constructed features. Therefore, malware classification methods based on malware images and deep learning offer an effective solution. This approach involves first converting malicious code into images, and then using a deep learning model to classify the images.

[0008] After detecting malware, it is often categorized into families for better analysis. However, current mainstream image-based malware family classification methods face a problem: malware binary data is originally one-dimensional; how to convert it into two-dimensional data? The current approach is to first set a fixed width and then convert the malware binary file into an image. In other words, the width of the malware is set to a fixed value. This is clearly unreasonable, as malware sizes vary. Furthermore, setting a fixed width for the malware and truncating it may lead to semantic inconsistencies; this problem remains to be solved. Summary of the Invention

[0009] This invention proposes a malicious code family classification method that integrates Efficient-Net and 1D-CNN. The malicious code is visualized and then input into Efficient-Net and 1D-CNN in parallel. Finally, a feature pyramid fusion method is used to fuse the feature maps from the two networks, and the fused feature map is used to classify the malicious code family.

[0010] This invention proposes a method for classifying malware families that integrates Efficient-Net and 1d-CNN, comprising the following steps:

[0011] 1) A width-adaptive image processing method is used to process malicious code. After obtaining the PE file of the malicious code, it is disassembled to obtain its asm file, the .text field and .rdata field are extracted, and an adaptive width method is used to process it into an image.

[0012] 2) Input the malicious code image into the training model based on the efficient-net network: resize the malicious code image to a fixed size and then input it into the efficient-net network;

[0013] 3) Reduce the dimensionality of the input network data to 1 dimension, expand its dimensionality using an embedding algorithm, and input the expanded embedding matrix into the 1d-CNN network;

[0014] 4) After processing the features of each stage of Efficient-Net, they are fused with different feature maps of 1d-CNN, and these features are combined for prediction.

[0015] Furthermore, step 1) involves a width-adaptive visualization process for the malicious code, which includes:

[0016] a) Use IDA Pro disassembler to disassemble the malicious code PE file and obtain its corresponding asm file;

[0017] b) Extract the .text field containing code snippets and the .rdata field containing data from the asm file;

[0018] c) Count the number of bytes (size1) in the .text field and the number of bytes (size2) in the .radta field of the asm file, and set Wtext and Wrdata according to the calculation result of ⌈sqrt(size1+size2)⌉.

[0019] d) Set the width to size, set the padding size of the .text field to Wtext, and the padding size of the .rdata field to Wrdata. Then, visualize the malicious code to obtain an image of the malicious code.

[0020] Furthermore, in step 4), when fusing the two networks, the feature maps of each stage in Efficient-Net are first extracted, and then fused at different scales through operations such as dimensionality reduction and upsampling. Then, for different convolutional kernels in 1D-CNN, different feature maps are obtained, and these are horizontally linked with the feature maps of different scales in Efficient-Net to obtain the fused features.

[0021] The method of this invention can effectively classify malware families, and has the following advantages compared with existing technologies:

[0022] 1. A method for adaptively setting the width of malicious code images is proposed, which has better performance compared with directly setting a fixed image width;

[0023] 2. Using Efficient-Net as the network for classifying malware families, this network simultaneously adjusts the network model based on its depth, width, and resolution, resulting in better performance;

[0024] 3. A method combining Efficient-Net and 1D-CNN is proposed. This method preserves the texture features of the malicious code image and maximizes the semantic integrity of the malicious code as one-dimensional data. Attached Figure Description

[0025] Figure 1 is a system overall flowchart of the method of the present invention.

[0026] Figure 2 is a diagram of the network model architecture for the specific malicious code family classification method of the present invention.

[0027] Figure 3 shows an example of a malicious code family image input during the operation of the method of the present invention.

[0028] Figure 4 This is a comparative experiment of different image widths and the adaptive width setting method proposed in this invention.

[0029] Figure 5 is a comparative experimental diagram of different hyperparameters of 1d-cnn in the method of the present invention.

[0030] Figure 6 shows the detailed information of the malicious code dataset collected by the method of the present invention.

[0031] Figure 7 shows the experimental results of the method of the present invention on a malicious code dataset that was collected by ourselves.

[0032] Figure 8 shows the experimental results of the method of the present invention on the public dataset Malimg. Detailed Implementation

[0033] To make the above-mentioned features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0034] This invention presents a malware family classification method that integrates Efficient-Net and 1d-CNN, suitable for classifying malware families. The specific process is as follows: Figure 1 As shown, its main steps include:

[0035] Step 101: Use IDA Pro to disassemble the malicious code PE file to obtain the asm file;

[0036] Step 102: Extract the .text and .rdata fields from the asm file;

[0037] Step 103: Count the number of bytes (size1) in the .text field and the number of bytes (size2) in the .radta field of the asm file, and calculate according to the following rules:

[0038] a) Let ⌈sqrt(size1+size2)⌉=size3. If size3 * size3 = (size1+size2), set Wtext = Wrdata =0.

[0039] b) If size3 * size3 > (size1 + size2), the image needs to be padded. To divide the .text and .radta fields into different pixel rows of the image, they need to be padded separately. Calculate Wtext = size1 % size3, Wrdata = size2 % size3.

[0040] Step 104: Set the width to width=size3, set the padding size of the .text field to Wtext bytes, and the padding size of the .rdata field to Wrdata bytes. Visualize the malicious code to obtain an image of the malicious code.

[0041] Step 201: Resize the malicious code image to a fixed size, which is 224*224 in this case;

[0042] Step 202: Input the malicious code image into EfficientNet-B0 and pass it through the following convolutional networks: 32-channel Conv (3*3 kernel size), 16-channel MBConv1 (3*3 kernel size), 24-channel MBConv6 (3*3 kernel size), 40-channel MBConv6 (5*5 kernel size), 80-channel MBConv6 (3*3 kernel size), 112-channel MBConv6 (5*5 kernel size), 192-channel MBConv6 (5*5 kernel size), and 320-channel MBConv6 (3*3 kernel size).

[0043] Step 203: For the feature maps of each different convolutional network, a 1*1 convolution operation was performed on the outputs of the above 24-channel, 40-channel, 80-channel, 192-channel, and 320-channel networks to perform dimensionality reduction.

[0044] Step 204: The output of the last layer is M5 (320-channel output). It is upsampled and added bitwise to the output of the previous layer after a 1*1 convolution to obtain M4. The same operation is performed to obtain M3, M2, and M1.

[0045] Step 301: Resize the input malicious code image data into a one-dimensional vector.

[0046] Step 302: Input the one-dimensional data of the malicious code into the Embedding layer to obtain its embedding matrix. Here, the embedding dimension is 4.

[0047] Step 303: One-dimensional convolution kernels with sizes of 3, 4, and 5 were set, and convolution operations were performed on the embedding matrix with 100 convolution channels. Different feature maps were obtained respectively.

[0048] Step 401: For M1~M5 obtained in B3 of step B, perform 3*3 convolution to reduce dimensionality and eliminate the stacking effect caused by upsampling, and obtain P1~P5.

[0049] Step 402: Connect P1~P5 to the fully connected layer, outputting 1280 channels;

[0050] Step 403: Perform pooling operations on the different feature maps output from C3 to obtain P'1~P'3 (1*300 dimensions).

[0051] Step 404: Combine the outputs of P'1~P'3 and the 1280 channels, connect them to a fully connected classification layer, and output the number of channels as the number of malware family categories. Finally, connect to a softmax layer to output the code corresponding to the predicted malware family category.

[0052] Figure 2 The diagram below shows the architecture of the malicious code family classification network model specific to the method of this invention. Figure 3 The image shown is an example of an image generated using an adaptive width from different families of malware, as described in this invention. Figure 4 The experiment shows the impact of the width setting method and the fixed width setting method of the present invention on the accuracy of malware family classification. It can be seen that different width settings do affect the accuracy of malware family classification, and the method of the present invention has higher accuracy. Figure 5 These are some comparative experiments on the hyperparameters of 1d-CNN in the method of this invention. It can be concluded that the performance is best when the number of convolution kernels is 3, the embedding dimension is 4, and the convolution kernel size is (3,4,5). Figure 6 This is detailed information about malware collected from VirusShare by the method of this invention, including family names and the number of malware families. Figure 7These are experimental results on a self-collected dataset. The method proposed in this invention reduces the loss during training. Figure 7 -a), the loss in the test set decreased ( Figure 7 -b) is relatively smooth, without the "spurts" that appear in some of the comparison methods. However, in the test accuracy curve ( Figure 7 -c), this phenomenon is more pronounced. The figure shows that the comparison method exhibits significant accuracy fluctuations, indicating that its model has not yet converged. However, the model of this invention converges at approximately epoch 30. The final results are as follows: Figure 7 As shown in -d, this invention further improves the model accuracy on the baseline. Figure 8 These are experimental results on the public dataset Malimg. Figure 8 -a is the obfuscation matrix for the classification results of various malware families. Figure 8 -b indicates a comparison between this invention and those of several other scholars, demonstrating that this invention has better experimental performance and thus its effectiveness.

[0053] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for classifying malware families that integrates Efficient-Net and Id-CNN, characterized in that, include: A. Malicious code width adaptive image rendering, including the following steps: A1. Use IDA Pro to disassemble the malicious code PE file to obtain the asm file; A2. Extract the .text and .rdata fields from the asm file; A3. Count the number of bytes (size1) in the .text field and the number of bytes (size2) in the .rdata field of the asm file, according to the following rules: a) Let ⌈ sqrt(size1+size2) ⌉ = size3. If size3 * size3 = (size1+size2), set W... text = W rdata =0; b) If size3 * size3 > (size1 + size2), the image needs to be padded. To divide the .text and .rdata fields into different pixel rows of the image, they need to be padded separately. Calculate W. text = size1 % size3, W rdata = size2 % size3; A4. Set the width to width=size3, and set the padding size in bytes for .text to W. text The number of bytes to fill the .rdata field is W. rdata The malicious code is visualized to obtain a malicious code image; B. Input the malicious code image into the training model based on the Efficient-Net network, including the following steps; B1. Resize the malicious code image to a fixed size of 224*224; B2. Input the malicious code image into EfficientNet-B0, and pass it through the following convolutional networks: 32-channel Conv with a kernel size of 3*3, 16-channel MBConv1 with a kernel size of 3*3, 24-channel MBConv6 with a kernel size of 3*3, 40-channel MBConv6 with a kernel size of 5*5, 80-channel MBConv6 with a kernel size of 3*3, 112-channel MBConv6 with a kernel size of 5*5, 192-channel MBConv6 with a kernel size of 5*5, and 320-channel MBConv6 with a kernel size of 3*3. B3. For the feature maps of each different convolutional network, perform a 1*1 convolution operation on the outputs of the above 24-channel, 40-channel, 80-channel, 192-channel, and 320-channel networks, and then perform dimensionality reduction processing. B4, the last layer is the 320-channel output M5, which is upsampled and added to the output of the previous layer after 1*1 convolution to obtain M4. The same operation is used to obtain M3, M2, and M1. C. Input the malicious code image into the 1D-CNN-based training model, including the following steps: C1. Rescale the input malicious code image data into a one-dimensional vector; C2. Input the one-dimensional data of the malicious code into the embedding layer to obtain its embedding matrix. Here, the embedding dimension is 4. C3. Set 1D convolution kernels with kernel sizes of 3, 4, and 5, perform convolution operations on the embedding matrix, with 100 convolution channels, and obtain different feature maps respectively; D. Perform feature fusion on the two models, including the following steps: D1. For M1~M5 obtained in step B, perform 3*3 convolution to reduce dimensionality and eliminate the stacking effect caused by upsampling, and obtain P1~P5. D2. Connect P1~P5 to the fully connected layer, and the number of output channels is 1280; D3. Perform pooling operations on the different feature maps output in step C to obtain 1*300 dimension P1~P3; D4 combines the outputs of P1~P3 and 1280 channels, connects them to a fully connected classification layer, and outputs the number of channels as the number of malware family categories. Finally, it connects to a softmax layer and outputs the code corresponding to the predicted malware family category.

Images