A malware detection method integrating machine learning and deep learning

Abstract

The present invention discloses a malware detection method integrating machine learning and deep learning, and adopts a method combining machine learning (LightGBM) and deep learning (1D-CNN) as the basis of a malware detection model. The model can explore the deep features of semantics and the spatiotemporal sequence data features of semantic contextual relationships. At the same time, the feature extraction of the model and the model detection are coordinated to better propagate errors, so that the training speed is faster and the effect is better. At the same time, the model receives the detection sample and calculates it, so as to determine whether there is malware, which has a higher accuracy rate than the traditional direct entry into the detection model. In addition, the method of the present invention is simple, and the detection model is more lightweight. The model is not only suitable for malware detection on the Microsoft side, but also has good effects on the mobile side.

Description

Technical Field

[0001] The present invention relates to the technical field of software testing, and in particular to a malware detection method integrating machine learning and deep learning. Background Art

[0002] Malware refers to executable files such as viruses, worms and Trojans that perform malicious tasks on computer systems. They are designed to disrupt the normal operation of computer systems by collecting sensitive information or gaining unauthorized access to computer systems. Malware can not only affect infected computers or devices, but also other devices that communicate with the infected devices.

[0003] With the rapid popularization of the Internet, personal computers and mobile platforms, various types of malware have emerged in an endless stream. The malware market is healthy and has a huge market. Under the background of the continuous updating of network security mechanisms, malware can still cause huge losses to users. The rapid development of malware detection technology in recent years has made it a hot issue in the field of network security in academia. How to quickly and accurately detect whether the software to be detected is malware is an urgent problem to be solved in malware detection.

[0004] Malware detection system is a network security technology used to detect whether malware and samples are malicious and to actively defend against maliciousness. In the malware detection system, the most important part is to analyze the samples in the system or extracted to be tested and detect possible malware. At present, the research on malware detection system is mainly divided into two parts: static detection and dynamic detection.

[0005] 1) Static detection is to analyze the program itself without running it. Usually, the malicious program is disassembled directly from the binary file to be tested through a disassembly tool to extract the required static features as data for analysis. Static features generally include n-gram bit sequences, string features, control flow graphs, function calls, opcode frequencies, etc.

[0006] 2) Dynamic detection has higher detection efficiency than static detection. Dynamic analysis usually runs the program in a restricted environment (some programs require a specific environment, such as command line parameters, backdoor programs that meet specific conditions, etc.) and monitors its behavior. Although it has higher reliability, it is more dependent on performance and has higher consumption.

[0007] With the continuous development of machine learning methods, some machine learning methods have also been used for malware detection. Existing intrusion detection research based on machine learning mainly applies machine learning technology as a means of feature selection or feature extraction in malware detection systems, in order to obtain features that can better reflect the statistical characteristics of classification tasks. The system uses these features for pattern recognition, which can effectively detect the specific type and location of malware, and obtain a higher malware detection accuracy.

[0008] Traditional machine learning algorithms include decision tree learning, support vector machines, random forests, Bayesian networks, etc. However, there are also problems such as long model training time, high feature redundancy obtained by feature engineering, and data imbalance affecting detection performance. At the same time, existing studies have shown that the application of a single machine learning algorithm is difficult to improve the detection performance of the detection system in a complex data environment. Therefore, many studies have proposed models that combine machine learning technology with different training algorithms, data processing algorithms, and classification algorithms to address these problems.

[0009] Deep learning is a new artificial intelligence method developed on the basis of machine learning. Deep learning has extremely strong nonlinear fitting capabilities and can extract the main features from complex features. Deep learning has achieved great success in image recognition, natural language processing, recommendation and other fields. The use of deep learning methods in the field of malware detection has also made some progress.

[0010] Existing technical solutions, such as ScaleMalNet, are divided into two stages: in the first stage, malware is classified by combining static and dynamic analysis; in the second stage, malware is classified into corresponding malware categories using image processing methods. The framework collects malware samples from different sources in a distributed manner and applies preprocessing in a distributed manner to process a large number of malware samples on demand in real time. The ScaleMalNet framework conducts in-depth learning of malware collected by end-user hosts. The detection stage is to use the trained model and extracted features to detect malware, and finally give the malware classification if it is determined to be malware.

[0011] The existing technical solutions mainly have two disadvantages:

[0012] First, the feature extraction time is relatively long. The existing technical methods, whether directly extracting from malware exe files or malicious codes, essentially extract features from the source code level. There are many features to be extracted and the time is relatively long, which affects the accuracy.

[0013] Second, the algorithm model has defects. Most of the existing algorithm models are machine learning algorithms or conventional deep learning models, and their stability in hostile environments is difficult to guarantee. Summary of the invention

[0014] Based on this, the purpose of the present invention is to provide a malware detection method that integrates machine learning and deep learning. First, it solves the problem that all features need to be extracted, resulting in a long feature extraction time and thus a long overall detection time; second, it solves the problem that too many features affect the accuracy; third, it improves stability in a hostile environment.

[0015] In order to achieve the above object, the present invention provides the following technical solutions:

[0016] The present invention provides a malware detection method integrating machine learning and deep learning, comprising the following steps:

[0017] S1. Perform feature dimension reduction processing and feature importance sorting and screening on the original data set;

[0018] S2. Use the training data to train and fine-tune the model, obtain the trained detection model and save it;

[0019] S3. Use the detection model to detect the test data and obtain the detection results.

[0020] Furthermore, the method for ranking and screening the feature importance in step S1 is:

[0021] 1) Remove most attributes with missing attribute values;

[0022] 2) Delete attributes with unbalanced attribute values;

[0023] 3) Fill the missing values ​​of the attributes in the sample, and select the mode of the sample set attribute with the same sample label to fill the missing values;

[0024] 4) Quantization encoding of feature attributes: Encode discrete feature attributes from 0-m, where m represents the total number of types.

[0025] Furthermore, the method of feature dimensionality reduction processing in step S1 is:

[0026] The features are trained through the LightGBM model and then the dimensionality of the features is reduced. The extracted features are top-k sorted and output according to the feature importance and cumulative importance, which serves as the input of the subsequent malware detection 1D-CNN neural network model.

[0027] Furthermore, in step S1, the data features are reduced from 83 dimensions to 71 dimensions.

[0028] Furthermore, the set threshold of the cumulative importance in step S1 is 0.95.

[0029] Furthermore, in the LightGBM model, according to the forward step algorithm, the model of the mth step is expressed as:

[0030] f m (x) = f m-1 (x)+T(x,θ m ) (2)

[0031] In the formula, T(x, θ m ) represents a decision tree, θ m is the decision tree parameter, M is the number of trees;

[0032] Let y i is the true value of the i-th sample, f m (x i ) is the predicted value of the i-th sample, and the loss function is taken as the square loss, then the loss function is expressed as:

[0033]

[0034] According to formula (4), the loss function is minimized, and the parameters It is expressed as:

[0035]

[0036] Furthermore, step S2 updates the regression tree through multiple iterations to obtain the final detection model.

[0037] Furthermore, the test steps of step S3 using the detection model are as follows: the test data samples are subjected to dimensionality reduction processing on the sample features by LightGBM and are sorted and screened according to the feature importance, and then input into the 1D-CNN neural network, and the detection is performed by the 1D-CNN neural network to output the detection results.

[0038] Furthermore, the 1D-CNN neural network consists of three convolutional layers and a max pooling layer, and each layer is rolled into a product layer of size 5×1, 3×1, and 3×1.

[0039] Furthermore, the detection process of the 1D-CNN neural network is as follows: after the final expansion into a feature vector of size 112, after two layers of dense connection, the output size is 1×2 to obtain a low-dimensional dense vector. During training, the number of samples selected for one training is 128, the optimizer uses the Adam algorithm, the initial learning rate is 0.01, the regularization coefficient is 0.001, and the obtained vector is input into the 1D-CNN neural network. The feature continues to be reduced in dimension, and the feature is reduced from 71 dimensions to 42 dimensions for detection and output.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] The malware detection method of the present invention, which integrates machine learning and deep learning, adopts a method combining machine learning (LightGBM) and deep learning (1D-CNN) as the basis of the malware detection model. The model can explore the deep features of semantics and the spatiotemporal sequence data features of semantic contextual relationships. At the same time, the feature extraction of the model and the model detection are coordinated to better propagate errors, making the training speed faster and the effect better. At the same time, the model receives the detection sample and calculates it to determine whether there is malware, which has a higher accuracy rate than the traditional direct entry into the detection model. In addition, the method of the present invention is simple, and the detection model is more lightweight. The model is not only suitable for malware detection on the Microsoft side, but also has good effects on the mobile side. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0043] Figure 1 A flowchart of a malware detection method integrating machine learning and deep learning provided by an embodiment of the present invention;

[0044] Figure 2 A feature importance graph provided for an embodiment of the present invention;

[0045] Figure 3 A feature cumulative importance graph provided for an embodiment of the present invention;

[0046] Figure 4 A basic structure diagram of 1D-CNN provided by an embodiment of the present invention;

[0047] Figure 5 A 1D-CNN neural network architecture diagram provided by an embodiment of the present invention;

[0048] Figure 6 A flow chart of using a detection model for detection provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0050] The embodiment of the present invention provides a malware detection method integrating machine learning and deep learning. The detection process is as follows: Figure 1 shown.

[0051] First, the original data set is feature screened and processed, and the training set and test set are divided into 7:3. The training data is used to train and fine-tune the model, and the trained detection model is obtained and saved. The detection model is used to predict the test set (test data), and the prediction results are obtained and analyzed. According to the applicant's research, the division of the training set and the test set into 7:3 is the best ratio, which can not only ensure the number of training sets during training, but also avoid overfitting, and at the same time ensure the number of test sets and avoid contingency.

[0052] The specific steps are as follows.

[0053] Step 1: Data Preprocessing

[0054] (1) The first manual operation consists of four steps:

[0055] 1) Delete most attributes that are missing attribute values. For example, some data lacks most of the features with higher scores. Since there are too many missing values, they are not only of no reference value, but also affect the accuracy when input into the model.

[0056] 2) Delete attributes with unbalanced attribute values; for example, if the features of some data are particularly high in a certain score, it can be concluded that they belong to a certain type of infection, and no training and testing are required;

[0057] 3) Fill the missing values ​​of the attributes in the sample, and select the mode of the sample set attributes with the same sample label to fill the missing values, rather than selecting the mode of all sample attributes, to ensure the validity of the data;

[0058] 4) Quantitative encoding of feature attributes: Encode discrete feature attributes from 0-m, where m represents the total number of types. Quantitative encoding of feature attributes uses feature engineering technology to delete, fill, sort, and filter features, and then uses deep learning technology for detection, reducing the interference of irrelevant features on deep learning model detection.

[0059] (2) The most important thing is that the present invention trains the features through the LightGBM model, reduces the dimensionality of the features (from 83 dimensions to 71 dimensions, and experiments have shown that 71 has the best effect), and sorts the extracted features in top-k order according to feature importance and feature cumulative importance and outputs them as input for the subsequent malware detection 1D-CNN neural network model.

[0060] When performing feature extraction, the present invention extracts only part of the features for training after filling in the features, and only inputs the extracted part of the features into a one-dimensional convolutional neural network (CNN) for detection. This method can improve detection efficiency while improving accuracy.

[0061] The present invention adopts a distributed gradient boosting framework (Light Gradient Boosting Machine, LightGBM) based on a decision tree algorithm. LightGBM is a gradient boosting framework, and its core is the gradient boosting decision tree (Gradient Boosting Decision Tree, GBDT) algorithm. GBDT is a decision tree algorithm based on iterative construction and can be used for regression and classification tasks. It uses a classification regression tree model as a weak learner, builds a new learner in the direction of the gradient descent of the loss function of the previous learner, and trains the model through continuous iteration. There is a residual between the predicted value and the actual value of each round in the iterative process. The next round will be predicted based on the residual, and finally all predictions will be added as the final conclusion. GBDT is shown in formula (1):

[0062]

[0063] Since the data volume contained in all current problem solutions is aggregated together, the accuracy and computational efficiency of a single GBDT algorithm can no longer meet the requirements. Therefore, the present invention introduces the LightGBM algorithm. LightGBM is shown in formula (2), where T(x, θ m ) represents a decision tree, θ m is the decision tree parameter, and M is the number of trees. According to the forward step algorithm, the model of the mth step can be expressed as:

[0064] f m (x) = f m-1 (x)+T(x,θ m ) (2)

[0065] Let y i is the true value of the i-th sample, f m (x i ) is the predicted value of the i-th sample, and the loss function is taken as the square loss, then the loss function can be expressed as:

[0066]

[0067] According to formula (4), the loss function is minimized, and the parameters

[0068]

[0069] Through multiple iterations, the regression tree is updated to obtain the final model.

[0070] LightGBM uses a histogram-based segmentation algorithm to replace the traditional pre-sort traversal algorithm. Compared with the traditional GBDT algorithm, the LightGBM algorithm improves the efficiency of the algorithm in the following aspects:

[0071] 1. Faster training speed and higher efficiency: LightGBM uses a histogram-based algorithm to store continuous feature values ​​in discrete boxes to speed up the training process.

[0072] 2. Lower memory usage: LightGBM replaces continuous values ​​with discrete bins, thereby reducing memory usage.

[0073] 3. More accurate than any other boosting algorithm: Compared with traditional strategies, LightGBM uses a leaf-wisegrowth strategy, which can reduce the loss for each leaf grown, and requires setting additional parameters to avoid overfitting.

[0074] 4. LightGBM uses the feature bundling method. There are multiple eigenvalues ​​in high-dimensional data, and there is information redundancy between the eigenvalues. The feature bundling method puts the above eigenvalues ​​into a sparse space to reduce the computational complexity.

[0075] In summary, LightGBM has faster training speed and higher efficiency, takes up less memory, and has higher accuracy.

[0076] During model training, after multiple experiments, the parameters used by LightGBM are shown in Table 1.

[0077] Table 1 Preprocessing parameter settings

[0078] Improved tree type GBDT Number of trees 12000 Training feature sampling rate 0.611 L1 regularization coefficient 0.632 L2 regularization coefficient 0.631 Learning Rate 0.0106 Maximum Depth -1(Unlimited depth) Training sample sampling rate 0.82 Maximum number of leaf nodes per tree 160

[0079] LightGBM sorts the feature importance and cumulative feature importance while reducing the original feature dimension. The feature importance graph and cumulative feature importance are shown in the figure. Figure 2 , Figure 3 As shown, Figure 2 Sort the importance of each feature in a single data. Figure 3 This is the ranking of the importance of features in all data. Subsequent experiments select features based on the ranking of importance for model training for subsequent testing.

[0080] Step 2: Detection model: The overall structure of the detection model is as follows Figure 4 shown.

[0081] First, the samples of the data set are reduced in dimension by LightGBM feature engineering (from 83 dimensions to 71 dimensions), sorted by importance, and the top-k features are selected and input into the 1D-CNN neural network. In this invention, all features whose cumulative importance reaches the set threshold (the threshold is set to 0.9-0.95 in the embodiment of the invention) are selected as the input features of 1D-CNN. The choice of threshold is a key factor affecting the results, such as Figure 2 As shown in Figure 1, if the threshold is too small, many features cannot be selected. For example, if the threshold is 0.6, Figure 2 As shown in the figure, there are many features in the range of 0.6-0.9. These features have high scores and are numerous, but they cannot be selected, which will have a great impact on the experiment and easily eliminate relevant features that are helpful for judgment. If the threshold is too large, such as features above 0.95, they are basically not very helpful for the experiment and it is easy to introduce more irrelevant features. For example, "local English name information" above 0.95, common sense knows that the name of the host has nothing to do with whether it is attacked.

[0082] Next, the 1D-CNN model is used for detection. Before converting the text sequence into a digital vector, it is converted into a bytecode sequence. This method can better solve the overfitting problem of the neural network and mine deeper code associations. The 1D-CNN network used in this experiment is mainly composed of three convolutional layers + maximum pooling layers. Each layer is rolled into a product layer of size 5×1, 3×1, and 3×1, and finally expanded into a feature vector of size 112. After two layers of dense connection, the output size is 1×2 to obtain a low-dimensional dense vector. During training, the number of samples selected for one training is 128. The optimizer uses the Adam algorithm, the initial learning rate is 0.01, and the regularization coefficient is 0.001. The 71-dimensional features input into the 1D-CNN neural network are further reduced to 42 dimensions for detection and output results.

[0083] 1D-CNN is a special neural network used to process sequence data. It consists of convolutional layers, pooling layers, and fully connected layers. Its basic structure is as follows Figure 5 As shown in the figure, the convolution layer can obtain a set of optimal convolution kernels that meet the minimum loss function through training, and use the convolution kernels to achieve automatic feature extraction. The pooling layer can extract the most important features from the convolution layer and perform dimensionality reduction operations in the time dimension. The superposition of convolution layers and pooling layers forms a deep network structure, which extracts high-level sequence features through layer-by-layer abstraction.

[0084] X=[x 1 , x 2 , ..., x t , ..., x s ] T Passed as model input to the input layer, where x∈R s×dis the feature sequence, s is the length of the feature sequence, d is the number of eigenvalues, x t represents the tth eigenvalue vector, x t The dimension of is d. The sequence data is mapped to the convolution layer through a one-dimensional convolution operation, as shown in formula (5) and formula (6):

[0085]

[0086] f r (z) = max(z, 0) (6)

[0087] Where: * represents one-dimensional convolution operation; Represents the convolution kernel The jth feature map generated; j∈[1,n c ],n c Represents the number of convolution kernels; convolution kernel is the weight matrix, where m is the size of the convolution kernel. For feature sequences, it represents the local window width when extracting features, and b is the Bias; f r (z) is the activation function, which is used to perform nonlinear processing on the data after the convolution operation.

[0088] The present invention uses the mainstream activation function ReLu in deep learning, which can accelerate the convergence of the model and enhance the sparse representation of the model.

[0089] Pooling is used to capture the most useful information of the sequence features of the convolutional layer to form a pooling layer. The pooling operation is usually the maximum pooling (max-pooling), as shown in formula (7), the sequence length can be halved. When the pooling operation is used for the last time, the global maximum pooling is used, as shown in formula (8), to capture the most useful global timing information and reduce the sequence length to 1.

[0090]

[0091]

[0092] The fully connected layer is consistent with the traditional neural network structure and consists of multiple hidden layers. The fully connected layer further abstracts and combines global features and outputs the following:

[0093]

[0094] Where: W fc ∈R nfc is the weight matrix of the fully connected layer; nfc is the number of hidden units. The activation function f r (z) is also ReLu. For the binary classification problem, the number of output units is 1, and the classification result is output after full connection:

[0095]

[0096]

[0097] Activation function f σ (z) is the sigmoid function. The final output classification result Represents the probability of belonging to different categories.

[0098] The 1D-CNN neural network architecture used in the embodiment of the present invention is as follows: Figure 5 As shown. The details of 1D-CNN are as follows:

[0099] a. Structure: The 1D-CNN network is mainly composed of three convolutional layers + a maximum pooling layer, each of which is rolled into a product layer of size 5×1, 3×1, 3×1

[0100] b. Connection mode: full connection.

[0101] c. Convolutional layer activation function: ReLU.

[0102] d. Output layer activation function: Softmax

[0103] d. Loss function: Categorical cross-entropy.

[0104] f. Optimizer: Adam.

[0105] g. Training algorithm: back propagation algorithm.

[0106] h, Dropout: Dropout = 0.1

[0107] This module uses the trained model to detect malware on the target sample. It will provide information such as whether the code contains malware and what kind of malware exists. Currently, most malware detection models constructed using CNN are two-dimensional. Two-dimensional CNN has achieved great success in the field of malware detection and image detection, but there is little research on 1D-CNN. This model proves that 1D-CNN is also applicable to the field of malware detection.

[0108] The malware detection process of the present invention integrating machine learning and deep learning is as follows: Figure 6 Specifically, by obtaining the original data (such as the machine status code), the original data is preprocessed to generate a sample set, which is input into the detection model in batches, and the sample features are reduced in dimension by LightGBM. After being processed by LightGBM and sorted according to the importance of the features, the sample features are input into the 1D-CNN detection module for detection, and the detection results are output.

[0109] For the analysis method of the output results, a softmax classifier can be used to classify the output to obtain the final prediction result.

[0110] The present invention adopts a method combining machine learning (LightGBM) and deep learning (1D-CNN) as the basis of a malware detection model. The model can explore the deep features of semantics and the spatiotemporal sequence data features of semantic contextual relationships. At the same time, the feature extraction of the model and the model detection are coordinated to better propagate errors, making the training speed faster and the effect better. The model receives the detection sample for calculation, thereby determining whether there is malware, which has a higher accuracy rate than the traditional direct detection model. At the same time, the model of the present invention is more lightweight, and the model is not only suitable for malware detection on the Microsoft side, but also has good effects on the mobile side.

[0111] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0112] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, electronic device embodiment, computer-readable storage medium embodiment, and computer program product embodiment, since they are basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0113] The above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the aforementioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the aforementioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical specialties therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A malware detection method integrating machine learning and deep learning, characterized in that: The following steps are involved: S1. Perform feature dimension reduction processing and feature importance sorting and screening on the original data set; The method for sorting and screening feature importance in step S1 is: 1) Remove most attributes with missing attribute values; 2) Delete attributes with unbalanced attribute values; 3) Fill the missing values ​​of the attributes in the sample, and select the mode of the sample set attribute with the same sample label to fill the missing values; 4) Quantization encoding of feature attributes: Encode discrete feature attributes from 0-m, where m represents the total number of types; The method of feature dimensionality reduction processing in step S1 is: The features are trained through the LightGBM model to reduce the dimensionality of the features, and the extracted features are sorted and output in top-k order according to feature importance and cumulative importance, which are used as the input of the subsequent malware detection 1D-CNN neural network model; the threshold of feature cumulative importance is set to 0.95; In the LightGBM model, according to the forward step algorithm, the model of the mth step is expressed as: f m (x)=f m-1 (x)+T(x,θ m ) (2) In the formula, T(x,θ m ) represents a decision tree, θ m is the decision tree parameter, M is the number of trees; Let y i is the true value of the i-th sample, f m (x i ) is the predicted value of the i-th sample, and the loss function is taken as the square loss, then the loss function is expressed as: According to formula (4), the loss function is minimized, and the parameters It is expressed as: S2. Use the training data to train and fine-tune the model. Through multiple iterations, update the regression tree to obtain the trained detection model and save it. S3, using the detection model to detect the test data and obtain the detection result; The test steps using the detection model are as follows: the test data samples are processed by the LightGBM model to reduce the dimension of the sample features and sort and filter according to the importance of the features, and then input into the 1D-CNN neural network, and the 1D-CNN neural network is used for detection, and the detection results are output; The 1D-CNN neural network consists of a convolutional layer, a pooling layer, and a fully connected layer. The input of the 1D-CNN neural network is represented as X = [x1, x2, ..., x t ,…,x s ] T , where x∈R s×d is the feature sequence, s is the length of the feature sequence, d is the number of eigenvalues, x t represents the tth eigenvalue vector, x t The dimension is d; the sequence data is mapped to the convolution layer through a one-dimensional convolution operation, as shown in formula (5) and formula (6): f r (z)=max(z,0) (6) Where: * represents one-dimensional convolution operation; Represents the convolution kernel The jth feature map generated; j∈[1,n c ],n c Represents the number of convolution kernels; convolution kernel is the weight matrix, where m is the size of the convolution kernel. For feature sequences, it represents the local window width when extracting features, and b is the Bias; f r (z) is an activation function, which is used to perform nonlinear processing on the data after convolution operation; The maximum pooling operation is shown in formula (7), and the sequence length is halved; when the pooling operation is used for the last time, the global maximum pooling is used, as shown in formula (8), to capture the most useful global timing information and reduce the sequence length to 1; The fully connected layer further abstracts and combines the global features, and the output is as follows: Where: W fc ∈R nfc is the weight matrix of the fully connected layer; nfc is the number of hidden units; the activation function f r (z) is the ReLu function; for the binary classification problem, the number of output units is 1, and the classification result is output after full connection: Activation function f σ (z) is the sigmoid function, and the final output classification result Represents the probability of belonging to different categories.

2. The malware detection method integrating machine learning and deep learning according to claim 1, characterized in that: In step S1, the data features are reduced from 83 dimensions to 71 dimensions.

3. The malware detection method integrating machine learning and deep learning according to claim 1, characterized in that: The 1D-CNN neural network consists of three convolutional layers and a maximum pooling layer, and each layer is rolled into a product layer of size 5×1, 3×1, and 3×1.

4. The malware detection method integrating machine learning and deep learning according to claim 3, characterized in that: The detection process of the 1D-CNN neural network is as follows: after the final expansion into a feature vector of size 112, after two layers of dense connection, the output size is 1×2 to obtain a low-dimensional dense vector. During training, the number of samples selected for one training is 128. The optimizer uses the Adam algorithm, the initial learning rate is 0.01, and the regularization coefficient is 0.

001. The obtained vector is input into the 1D-CNN neural network, and the feature continues to be reduced in dimension. After the feature dimension is reduced from 71 dimensions to 42 dimensions, the detection is performed and the results are output.

Images