Malicious program detection model updating method and device, equipment and medium

Abstract

The present disclosure relates to a malicious program detection model updating method, device, equipment and medium. The method comprises: detecting a probability value of a target program sample being a malicious program by a malicious program detection model; adding an API sequence corresponding to the target program sample to a training set in a case where the probability value is lower than a preset probability threshold; API sequence samples in the training set comprise API sequences corresponding to the target program sample and a plurality of pre-existing malicious program samples respectively; using a density clustering algorithm to cluster the API sequence samples in the training set, and performing sample extraction on each class to obtain a verification set; and training and updating the malicious program detection model based on the training set and the verification set. The present disclosure can save human consumption and space consumption while ensuring model performance.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to methods, apparatus, devices and media for updating malicious program detection models. Background Technology

[0002] With the rapid development of the internet, malware is also constantly evolving. Dynamic detection is a major method for malware detection. It studies the behavior of malware during its operation, learns from known malware behaviors to identify patterns, and thus can identify new malware. Learning through machine learning is a crucial approach to malware detection. However, as malware is constantly updated, the detection performance of models deteriorates, and older models become inadequate for new detection requirements. To adapt the model to new malware, a new model version needs to be trained from scratch using the entire dataset, including both new and old samples. Retraining with all the data consumes significant time and computational resources; if the data volume is massive, batch learning algorithms may not even be feasible. Summary of the Invention

[0003] To address the aforementioned technical problems, this disclosure provides a method, apparatus, device, and medium for updating a malicious program detection model.

[0004] This disclosure provides a method for updating a malicious program detection model, including:

[0005] The probability value of detecting a target program sample as malicious by a malicious program detection model;

[0006] If the probability value is lower than a preset probability threshold, the API sequence corresponding to the target program sample is added to the training set; the API sequence samples in the training set include the API sequences corresponding to the target program sample and multiple pre-existing malicious program samples.

[0007] The API sequence samples in the training set are clustered using a density clustering algorithm, and samples are extracted from each cluster to obtain a validation set.

[0008] The malware detection model is trained and updated based on the training set and the validation set.

[0009] Optionally, the probability value of detecting a target program sample as malicious by the malicious program detection model includes:

[0010] Extract the dynamic behavior API sequence of the target program sample during its execution;

[0011] The dynamic behavior API sequence is MD5 encoded and vectorized to obtain the target sample vector;

[0012] The target sample vector is input into a malicious program detection model for detection, and the probability value that the target program sample is a malicious program is obtained.

[0013] Optionally, the extraction of the dynamic behavior API sequence of the target program sample during runtime includes:

[0014] Run the target program sample in a pre-defined virtual operating system environment;

[0015] Extract the dynamic behavior logs generated during the execution of the target program sample;

[0016] Extract the dynamic behavior API sequence from the dynamic behavior log.

[0017] Optionally, extracting the dynamic behavior API sequence from the dynamic behavior log includes:

[0018] Extract the initial API sequence from the dynamic behavior log;

[0019] The initial API sequence is pruned and deduplicated to obtain the final dynamic behavior API sequence.

[0020] Optionally, during the initial model training, the step of training and updating the malware detection model based on the training set and the validation set includes:

[0021] The API sequence samples in the training set are vectorized based on the pre-trained initial API lexicon to obtain the first training sample vector;

[0022] The API sequence samples in the verification set are vectorized according to the initial API lexicon to obtain the first verification sample vector;

[0023] The preset text convolutional neural network is trained based on the first training sample vector and the first verification sample vector.

[0024] The trained text convolutional neural network is used as the malware detection model.

[0025] Optionally, when the model is not being trained for the first time, the step of training and updating the malware detection model based on the training set and the validation set includes:

[0026] The corresponding second training sample vector and second verification sample vector are obtained based on the training set and the verification set, respectively.

[0027] The first malware detection model is trained based on the second training sample vector to obtain the second malware detection model; wherein, the first malware detection model is the model obtained after the previous model training.

[0028] Verify whether the performance of the second malicious program detection model has been improved based on the second verification sample vector;

[0029] If so, update the second malicious program detection model to a new malicious program detection model and delete the first malicious program detection model from the preset buffer space.

[0030] If not, roll back from the buffer space to the first malicious program detection model.

[0031] Optionally, obtaining the corresponding second training sample vector and second verification sample vector based on the training set and the verification set respectively includes:

[0032] The first API vocabulary is updated to obtain the second API vocabulary; wherein, the first API vocabulary is the API vocabulary obtained during the previous model training.

[0033] The API sequence samples in the training set are dimensionality reduced using the principal component analysis longitudinal dimensionality reduction algorithm to generate API sequence training samples.

[0034] The API sequence samples in the validation set are dimensionality reduced using the principal component analysis longitudinal dimensionality reduction algorithm to generate API sequence validation samples.

[0035] The API sequence training samples and API sequence verification samples are vectorized respectively to obtain their respective second training sample vectors and second verification sample vectors.

[0036] This disclosure also provides an apparatus for updating a malicious program detection model, comprising:

[0037] The program detection module is used to detect the probability value of a target program sample being malicious through a malicious program detection model;

[0038] The training set update module is used to add the API sequence corresponding to the target program sample to the training set when the probability value is lower than a preset probability threshold; the API sequence samples in the training set include the API sequences corresponding to the target program sample and multiple pre-existing malicious program samples.

[0039] The validation set update module is used to cluster the API sequence samples in the training set using a density clustering algorithm, and to extract samples from each cluster to obtain the validation set.

[0040] The model update module is used to train and update the malicious program detection model based on the training set and the validation set.

[0041] This disclosure also provides an electronic device, the electronic device comprising:

[0042] processor;

[0043] Memory used to store the processor's executable instructions;

[0044] The processor is configured to read the executable instructions from the memory and execute the instructions to implement the above method.

[0045] This disclosure also provides a computer-readable storage medium storing a computer program for performing the above-described methods.

[0046] The technical solution provided in this disclosure has the following advantages compared with the prior art:

[0047] The malicious program detection model update method, apparatus, device, and medium provided in this disclosure include: determining the probability value of a target program sample being a malicious program using the malicious program detection model; adding the API sequence corresponding to the target program sample to the training set when the probability value is lower than a preset probability threshold; clustering the API sequence samples in the training set using a density clustering algorithm, and extracting samples from each cluster to obtain a validation set; and training and updating the malicious program detection model based on the training set and the validation set. This disclosure can save manpower and space consumption while ensuring model performance. Attached Figure Description

[0048] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0049] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a flowchart of the method for updating the malicious program detection model according to an embodiment of this disclosure;

[0051] Figure 2 This is a schematic diagram of the API sequence extraction process described in an embodiment of this disclosure;

[0052] Figure 3 This is a schematic diagram of the malicious program detection process described in the embodiments of this disclosure;

[0053] Figure 4 This is a schematic diagram of the model training and update process described in the embodiments of this disclosure;

[0054] Figure 5 This is a schematic diagram of the adaptive learning framework described in an embodiment of this disclosure;

[0055] Figure 6 This is a structural block diagram of the malicious program detection model update device described in the embodiments of this disclosure;

[0056] Figure 7 This is a schematic diagram of the structure of the electronic device described in an embodiment of this disclosure. Detailed Implementation

[0057] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0058] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0059] Currently, most methods for malware detection using machine learning are rule-based, requiring the creation of feature libraries based on rules. However, rule extraction and maintenance of these libraries require specialized personnel, resulting in high manpower costs. Furthermore, these methods are ineffective at detecting unknown malware and consume significant storage space. To adapt to new and unknown malware, the model needs to be continuously trained and updated using the entire dataset, including both new and old samples. However, retraining with all the data consumes substantial time and computational resources, and if the data volume is enormous, batch learning algorithms may not even be feasible. In this context, embodiments of this disclosure provide a method, apparatus, device, and medium for updating a malware detection model.

[0060] Figure 1 This is a flowchart illustrating a method for updating a malware detection model according to an embodiment of this disclosure. This method can be executed by a malware detection model updating device configured on a terminal, which can be implemented in software and / or hardware. Figure 1 As shown, the method includes the following steps:

[0061] Step S102: Detect the probability value of the target program sample being a malicious program using a malicious program detection model.

[0062] In this embodiment, the execution process of the target program sample is simulated in a controllable virtual operating system. Dynamic behavior logs of system calls during execution are collected, and dynamic behavior API sequences of the target program sample are extracted from these logs. Each API sequence includes an API category and an API name. The API sequences used by malicious programs differ from those used by normal programs. Malicious programs may call APIs to perform operations such as modifying the registry, sending background messages, and remote control.

[0063] The dynamic behavior API sequence is MD5 encoded and vectorized to obtain the target sample vector. The target sample vector is then input into the loaded malware detection model for detection. The malware detection model outputs the probability value that the target program sample is a malware, which can be used for early warning and judgment.

[0064] Step S104: If the probability value is lower than the preset probability threshold, add the API sequence corresponding to the target program sample to the training set; the API sequence samples in the training set include the API sequences corresponding to the target program sample and multiple pre-existing malicious program samples.

[0065] This embodiment determines whether the probability value of the target program sample being malicious is lower than a preset probability threshold. If it is lower, it indicates that the target program sample is significantly different from previous malicious program samples and may belong to a new, unknown malicious program. In this case, the target program sample is automatically added to the training set, or in other words, the API sequence corresponding to the target program sample is added to the training set. Thus, the training set includes: multiple pre-existing sets of API sequences corresponding to malicious program samples and the API sequence corresponding to the newly added target program sample.

[0066] Step S106: Use density clustering algorithm to cluster the API sequence samples in the training set, and extract samples from each class to obtain the validation set.

[0067] In one embodiment, DBSCAN (Density-Based Spatial Clustering of Applications with Noise) is used to cluster the API sequence samples in the training set, and then a subset of samples is automatically extracted from each cluster as a validation set.

[0068] Step S108: Train and update the malware detection model based on the training set and validation set.

[0069] In this embodiment, through steps S102 to S106, new API sequence samples are accumulated in both the training and validation sets. Under these circumstances, the malware detection model can be trained and updated based on the training and validation sets. To minimize system resource consumption, this embodiment can initiate adaptive training updates by setting an update cycle or by using the sample collection data from the training set. The method for training and updating the malware detection model will be described in detail below.

[0070] To better understand the update method of the malicious program detection model, the embodiments of this disclosure are described in detail below.

[0071] Regarding step S102, this embodiment provides a specific method for detecting the probability value of a target program sample being malicious using a malicious program detection model, as shown below:

[0072] Extract the dynamic behavior API sequence of the target program sample during its execution.

[0073] Specifically, obtaining dynamic behavior requires actually running a sample of the target program, typically within a protected virtual operating system environment. Based on this, refer to... Figure 2 In this embodiment, the target program sample is run in a preset virtual operating system environment. The virtual operating system environment used is, for example, an application-level sandbox environment, which simulates the Windows system environment for program execution, resulting in fast execution speed. During the execution of the target program sample, it simulates operating system application programming interface (API) calls. Therefore, dynamic behavior logs generated by the target program sample during execution are extracted. Dynamic behavior API sequences are extracted from the dynamic behavior logs. If it is a malicious program, the extracted dynamic behavior API sequences will exhibit common operation sequences, such as modifying the registry, sending information in the background, and remote control.

[0074] When extracting dynamic behavior API sequences from dynamic behavior logs, refer to Figure 3 First, an initial API sequence can be extracted from the dynamic behavior log. Then, pruning and deduplication operations are performed on the initial API sequence to effectively remove some duplicate and irrelevant API sequences, thus obtaining the final dynamic behavior API sequence. Malicious programs sometimes execute a behavior multiple times, or a similar function multiple times, resulting in a large amount of duplication and redundancy in the API sequence. This redundant information increases the sequence length and model training complexity, and increases the model training time. Therefore, this embodiment performs pruning and deduplication operations on the initial API sequence to retain the valid dynamic behavior API sequence.

[0075] The dynamic behavior API sequence is MD5 encoded and vectorized to obtain the target sample vector. For example, for the dynamic behavior API sequence used as the test sample, the sequence length of each test sample can be preset to n lines (e.g., 1000 lines). If it is less than n lines, it is padded with 0s; if it exceeds n lines, it is truncated.

[0076] API sequences include API categories and API names, which would be cumbersome to process directly using a dictionary. To improve this, this embodiment encodes each pair of API categories and API names in each dynamic behavior API sequence with a sequence length of n lines using the MD5 algorithm, so that each API category and API name pair obtains a unique MD5 value; then, the MD5 values ​​are vectorized using a pre-loaded API dictionary model to obtain the target sample vector; the API dictionary model mentioned above is, for example, the Word2Vec model.

[0077] The target sample vector is input into the malware detection model for detection, and the probability value of the target program sample being a malware is obtained; this probability value can be used for early warning and judgment.

[0078] To ensure the timeliness of the malware detection model, new malware samples need to be added to the training set based on the model's performance. In this embodiment, if the probability value of a target program sample being malware is lower than a preset probability threshold, the target program sample is automatically added to the training set. A probability value lower than the preset probability threshold indicates that the target program sample is malware and is significantly different from previous malware samples, making it highly valuable as a malware sample. Thus, the training set includes: multiple pre-existing sets of API sequences corresponding to malware samples and the API sequences corresponding to the newly added target program samples. This method achieves fully automatic addition of samples to the training set, eliminating the need for manual addition.

[0079] For the validation set, it's crucial to verify not only the malware detection model's performance on old data but also its performance on new data. In this embodiment, the validation set can be updated by extracting representative samples from the training set. Specifically, density clustering is used to cluster the API sequence samples in the training set, and samples are extracted from each cluster to obtain the validation set. This update method allows the validation set to function effectively. Density clustering eliminates the need to specify clusters, ensuring representativeness. Representative samples from each category are included in the validation set, enabling the malware detection model to perform performance verification on each category (not just a single category). By using density clustering to extract representative samples from each category of API sequence samples into the validation set, this adaptive update method maintains the diversity and validity of the validation set, and requires no manual maintenance, achieving fully automated updates.

[0080] According to the above embodiments, after a period of accumulation, both the training and validation sets contain new API sequence samples. In this case, the adaptive training and update system of the model will learn in real time and can train and update the malware detection model based on the training and validation sets. To minimize system resource consumption, adaptive training and updates can be initiated by setting an update cycle or by collecting samples from the training set.

[0081] The method for training and updating the malware detection model can be found in [reference]. Figure 4 When performing model training and updates, first determine whether it is the first time training the model, and then use different methods for model training and updates.

[0082] In one embodiment, during initial model training, the malware detection model is trained and updated based on the training set and validation set, including:

[0083] (1) Vectorize the API sequence samples in the training set according to the pre-trained initial API vocabulary to obtain the first training sample vector.

[0084] The initial API lexicon is a model used to generate word vectors, such as Word2vec. This initial API lexicon needs to be generated during or before the initial model training. An exemplary training method is as follows: Each pair of API category and API name in a pre-prepared API sequence is encoded using the MD5 algorithm, resulting in a unique MD5 value for each API category and API name pair. Then, Word2vec is used to train the MD5 values, resulting in a trained MD5 value library for the API sequence. Finally, Word2vec is solidified to obtain a trained Word2vec library, which is the initial API lexicon.

[0085] The API sequence samples in the training set are MD5 encoded, and then the initial API lexicon mentioned above is loaded. The encoded API sequence samples are then vectorized according to the initial API lexicon, converting them into first training sample vectors that can be directly input into the model. Referring to the previous embodiment, the maximum sequence length of each API sequence sample is set to n; if it exceeds n, it is truncated; if it is less than n, it is padded.

[0086] (2) Vectorize the API sequence samples in the validation set according to the initial API lexicon to obtain the first validation sample vector.

[0087] The process of vectorizing API sequence samples in the validation set in this embodiment can be referred to the process of vectorizing API sequence samples in the training set described above, and will not be repeated here.

[0088] (3) The preset text convolutional neural network is trained based on the first training sample vector and the first verification sample vector.

[0089] Since this is the first training iteration, a model needs to be built. This embodiment uses a text convolutional neural network; specifically, the text convolutional neural network uses convolutional kernels with three convolution lengths of 3, 4, and 5. This processing is similar to the N-gram algorithm, which is equivalent to extracting features from 3, 4, and 5 adjacent API sequences. The number of kernels in each convolutional layer is set to 128. After convolution, max-pooling is used to extract the maximum value in the column vectors, and then the maximum values ​​corresponding to all convolution results are concatenated to form a fully connected layer. A dropout layer is added to the fully connected layer to prevent overfitting. After three fully connected layers, a softmax layer is used to output the classification result.

[0090] The first training sample vector and the first validation sample vector obtained in steps (1) and (2) are used to perform the initial training of the text convolutional neural network. Specifically, the first training sample vector corresponding to the training set is input into the text convolutional neural network for model training; the first validation sample vector corresponding to the validation set is used to validate the output of the text convolutional neural network; when the training of the text convolutional neural network reaches the preset requirements, the training is ended and the trained text convolutional neural network is saved for model solidification. Model solidification is to save the structure and parameters of the trained model.

[0091] (4) Use the trained text convolutional neural network as a malicious program detection model.

[0092] In one embodiment, when the model is not being trained for the first time, the malware detection model is trained and updated based on the training set and validation set, including:

[0093] (I) Obtain the corresponding second training sample vector and second validation sample vector based on the training set and validation set respectively.

[0094] This embodiment includes updating a first API dictionary to obtain a second API dictionary; wherein the first API dictionary is the API dictionary obtained during the previous model training; for example, if the current model training is the second time, then the first API dictionary is the initial API dictionary obtained during the first model training. In the specific update process, the first API dictionary is loaded, the API sequences of newly added samples are MD5 encoded, and the encoded API sequences are updated on the existing first API dictionary to obtain the second API dictionary. The API sequences of the newly added samples can be the API sequences corresponding to the target program samples.

[0095] In this embodiment, online incremental learning is fast and inexpensive, with each learning step being quick and easy. The model can dynamically acquire new data, and after learning new data, the old data is discarded. While incremental learning can quickly adapt to new data, it also quickly forgets old data. One challenge of incremental learning is that if some bad samples are used for training among the new samples, the system's performance will gradually decline, as this bad data may corrupt the model. Therefore, this embodiment needs to set up a mechanism to avoid this situation. Once it is found that new data has a detrimental effect on model performance, the update is abandoned, and the model is rolled back to the previous state. However, this model rollback requires the use of previous data, which consumes system storage space.

[0096] The key is to achieve rapid model rollback while enabling incremental learning without storing old data, and to address the issue of new models forgetting old data.

[0097] Based on this, this embodiment provides an anti-forgetting strategy, namely: using principal component analysis (PCA) as a longitudinal dimensionality reduction algorithm to reduce the dimensionality of API sequence samples in the training set, generating API sequence training samples. PCA retains important feature information by reducing the dimensionality of data features and is generally used for feature dimensionality reduction to ensure representativeness. In this embodiment, the feature dimensions and sample dimensions are swapped, and PCA, used for dimensionality reduction, is used to generate new samples. Using PCA longitudinally can generate representative samples from old data.

[0098] This example specifically reduces the dimensionality of API sequence samples in the training set of old data, generating multiple sets (e.g., 5 sets) of new representative samples. These new representative samples retain the important features of the original old data, eliminating the need to store the original old data. During incremental model training, these new representative samples are used together with the old data as API sequence training samples. The anti-forgetting strategy in this embodiment, by generating new representative samples, addresses the issue of gradual forgetting of old data during incremental model learning and avoids the large space consumption of storing old data. This allows the malware detection model to not only handle the continuous emergence of new, unknown, and novel malware but also maintain good detection performance against older malware.

[0099] For the validation set, the same method described above can be used to reduce the dimensionality of the API sequence samples in the validation set using the principal component analysis vertical dimensionality reduction algorithm to generate API sequence validation samples.

[0100] The API sequence training samples and API sequence validation samples are vectorized respectively to obtain their respective second training sample vectors and second validation sample vectors.

[0101] Of course, in another implementation, the execution order between dimensionality reduction and vectorization can be adjusted, i.e., referring to... Figure 4 After updating the second API lexicon, the API sequence samples in the training set and the validation set are vectorized respectively. Then, the vectorized sample vectors are reduced in dimensionality using the principal component analysis longitudinal dimensionality reduction algorithm, which also yields the second training sample vector and the second validation sample vector.

[0102] (II) The first malware detection model is trained based on the second training sample vector to obtain the second malware detection model; wherein, the first malware detection model is the model obtained after the previous model training. Figure 4 As shown, for non-initial training, the model structure and parameters of the first malware detection model that was trained previously need to be loaded. The second malware detection model performs adaptive incremental learning based on the first malware detection model, without having to start training the model from scratch, which greatly shortens the training time and makes the model update fast and cheap. At the same time, there is no need to save the already trained samples, saving the consumption of device storage space.

[0103] (III) Verify whether the performance of the second malware detection model has improved based on the second verification sample vector. If yes, update the second malware detection model to the new malware detection model and delete the first malware detection model from the preset buffer space. If no, roll back to the first malware detection model from the buffer space.

[0104] Regarding model rollback, this embodiment sets up a buffer space for temporary storage, where the first malware detection model obtained after the previous model training is temporarily stored. After model training, if the performance of the verified second malware detection model does not improve, the model update is abandoned, and the model is directly rolled back to the first malware detection model using the buffer space. If the performance of the verified second malware detection model improves, the first malware detection model in the buffer space is deleted, and the second malware detection model is updated to a new malware detection model. This embodiment, through model rollback, allows for a quick and timely rollback to the previous state when bad data interference is encountered during model updates, avoiding performance degradation caused by bad data.

[0105] In one embodiment, after the malicious program detection model completes online incremental learning and updates the samples in the training set and / or validation set using an anti-forgetting strategy, the current training set and / or validation set can be cleared for the next round of adaptive sample collection and update.

[0106] Compared to existing rule-based detection methods, the technical solution in this embodiment uses a deep learning model for malware detection, eliminating the need to store a large rule feature library. Furthermore, it employs a text convolutional neural network for model training, eliminating the need for manual feature selection. The adaptive update training method eliminates reliance on manual model updates, and incremental learning avoids the time-consuming problem of training the model from scratch. Utilizing buffer space for model rollback effectively addresses the issue of performance degradation and model corruption caused by some bad samples in new samples. Incremental learning discards samples after learning new ones to save storage space. Therefore, the model training method in the above embodiment, while performing incremental learning, avoids storing old data and achieves rapid model rollback, effectively solving the problem of the new model forgetting old data and maintaining model performance.

[0107] Based on the above embodiments, a method is provided herein as follows: Figure 5 The adaptive learning framework shown is used to implement a method for updating a malware detection model. In one application scenario, the adaptive learning framework consists of the following parts: an adaptive extraction module for program dynamic behavior, a model detection and early warning module, a model adaptive training and update module, an adaptive update module for the training set, and an adaptive update module for the validation set. This embodiment can call the above modules to perform malware detection and early warning, and model training and updating. The execution flow is shown below.

[0108] Start each module. After the module starts, input the target program sample to be tested.

[0109] The target program sample enters the program dynamic behavior adaptive extraction module, where it is simulated and runs to obtain dynamic behavior logs. Dynamic behavior API sequences are extracted from the dynamic behavior logs, and the dynamic behavior API sequences are deduplicated and pruned to remove redundant information, thus obtaining the final dynamic behavior API sequence corresponding to the target program sample.

[0110] The dynamic behavior API sequence is input into the model detection and early warning module. This module uses the MD5 algorithm to encode the dynamic behavior API sequence and a pre-loaded API dictionary to vectorize the encoded API sequence, obtaining the target sample vector. The target sample vector is then input into the pre-loaded malware detection model. The malware detection model outputs the probability value that the target program sample is malware, and an early warning is issued based on this probability value.

[0111] For the adaptive update module of the training set, a judgment is made based on the obtained probability value. If the probability value of the target program sample being a malicious program is low, it indicates that the target program sample is significantly different from the previous malicious programs. In this case, the API sequence corresponding to the target program sample should be added to the training set. At this time, the API sequence samples in the training set include the API sequences corresponding to the target program sample and the multiple pre-existing malicious program samples.

[0112] For the adaptive update module of the validation set, the adaptive update of the validation set adopts the density clustering method. The density clustering algorithm is used to cluster the API sequence samples in the training set, and a portion of representative samples from each category are extracted to the validation set. This can maintain the diversity of the validation set and the validation validity.

[0113] After a period of accumulation, new API sequence samples are accumulated in both the training and validation sets. The model adaptive training and update module will learn in real time. In order to minimize the consumption of system resources, adaptive training and updates can be started by setting an update cycle or by collecting samples from the training set.

[0114] During adaptive training and updates, a buffer space is used to temporarily store the first malware detection model obtained from the previous training. An anti-forgetting strategy is incorporated during adaptive updates to ensure the malware detection model remains effective not only on new data but also on older data. Adaptive training and updates of the malware detection model are performed based on the original model established after the previous training, eliminating the need for retraining from scratch. After training the new second malware detection model, it is validated using a validation set. If the model performance improves, the temporarily stored first malware detection model is removed, and the second malware detection model is used for updates; otherwise, a rollback is performed, quickly restoring the first malware detection model. This creates a closed loop for malware detection and alerting, allowing the malware detection model to become increasingly sophisticated over time.

[0115] In summary, the malware detection model update method provided in this disclosure offers a fully automated adaptive learning framework. It achieves fully automated adaptive updates across multiple aspects, including dynamic behavior extraction, model training and updates, model detection, and updates to the training and validation sets. The model matures over time without requiring manual updates and maintenance, ensuring model performance while saving significant manpower. An anti-forgetting strategy is added during the adaptive learning process. By generating representative samples, old data information is preserved while saving considerable space. This allows the model to effectively handle newly emerging malware and unknown, novel malware, while maintaining good detection performance against older malware. A rollback mechanism allows for rapid and timely reverting to the previous state when bad data interferes with model updates, preventing performance degradation caused by bad data.

[0116] Reference Figure 6 As shown, this embodiment provides an update device for a malicious program detection model, including:

[0117] The program detection module 602 is used to detect the probability value of a target program sample being a malicious program through a malicious program detection model;

[0118] The training set update module 604 is used to add the API sequence corresponding to the target program sample to the training set when the probability value is lower than a preset probability threshold; the API sequence samples in the training set include the API sequences corresponding to the target program sample and multiple pre-existing malicious program samples.

[0119] The validation set update module 606 is used to cluster the API sequence samples in the training set using a density clustering algorithm, and to extract samples from each cluster to obtain a validation set.

[0120] The model update module 608 is used to train and update the malicious program detection model based on the training set and the validation set.

[0121] The device provided in this embodiment has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0122] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Figure 7 As shown, the electronic device 700 includes one or more processors 701 and memory 702.

[0123] The processor 701 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 700 to perform desired functions.

[0124] The memory 702 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 701 may execute the program instructions to implement the malicious program detection model update method of the embodiments of this disclosure described above, and / or other desired functions. Various contents such as input signals, signal components, and noise components may also be stored in the computer-readable storage medium.

[0125] In one example, the electronic device 700 may further include an input device 703 and an output device 704, these components being interconnected via a bus system and / or other forms of connection mechanism (not shown). Furthermore, the input device 703 may also include, for example, a keyboard, a mouse, etc.

[0126] The output device 704 can output various information to the outside, including determined distance information, direction information, etc. The output device 704 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0127] Of course, for the sake of simplicity, Figure 7Only some of the components of the electronic device 700 relevant to this disclosure are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device 700 may include any other suitable components depending on the specific application.

[0128] Furthermore, this embodiment also provides a computer-readable storage medium storing a computer program for executing the above-described method for updating the malicious program detection model.

[0129] The computer program product of the method, apparatus, electronic device and medium for updating a malicious program detection model provided in this disclosure includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation, please refer to the method embodiments, which will not be repeated here.

[0130] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0131] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for updating a malicious program detection model, characterized in that, include: The probability value of detecting a target program sample as malicious by a malicious program detection model; If the probability value is lower than a preset probability threshold, the API sequence corresponding to the target program sample is added to the training set; the API sequence samples in the training set include the API sequences corresponding to the target program sample and multiple pre-existing malicious program samples. The API sequence samples in the training set are clustered using a density clustering algorithm, and samples are extracted from each cluster to obtain a validation set. The malicious program detection model is trained and updated based on the training set and the validation set. During the initial model training, the step of training and updating the malware detection model based on the training set and the validation set includes: The API sequence samples in the training set are vectorized based on the pre-trained initial API lexicon to obtain the first training sample vector; The API sequence samples in the verification set are vectorized according to the initial API lexicon to obtain the first verification sample vector; The preset text convolutional neural network is trained based on the first training sample vector and the first verification sample vector. The trained text convolutional neural network is used as the malware detection model.

2. The method according to claim 1, characterized in that, The probability value of detecting a target program sample as malicious by the malicious program detection model includes: Extract the dynamic behavior API sequence of the target program sample during its execution; The dynamic behavior API sequence is MD5 encoded and vectorized to obtain the target sample vector; The target sample vector is input into a malicious program detection model for detection, and the probability value that the target program sample is a malicious program is obtained.

3. The method according to claim 2, characterized in that, The extraction of the dynamic behavior API sequence of the target program sample during runtime includes: Run the target program sample in a pre-defined virtual operating system environment; Extract the dynamic behavior logs generated during the execution of the target program sample; Extract the dynamic behavior API sequence from the dynamic behavior log.

4. The method according to claim 3, characterized in that, Extracting the dynamic behavior API sequence from the dynamic behavior log includes: Extract the initial API sequence from the dynamic behavior log; The initial API sequence is pruned and deduplicated to obtain the final dynamic behavior API sequence.

5. The method according to claim 1, characterized in that, When the model is not being trained for the first time, the step of training and updating the malware detection model based on the training set and the validation set includes: The corresponding second training sample vector and second verification sample vector are obtained based on the training set and the verification set, respectively. The first malware detection model is trained based on the second training sample vector to obtain the second malware detection model; wherein, the first malware detection model is the model obtained after the previous model training. Verify whether the performance of the second malicious program detection model has been improved based on the second verification sample vector; If so, update the second malicious program detection model to a new malicious program detection model and delete the first malicious program detection model from the preset buffer space. If not, roll back from the buffer space to the first malicious program detection model.

6. The method according to claim 5, characterized in that, The step of obtaining the corresponding second training sample vector and second verification sample vector based on the training set and the verification set respectively includes: The first API vocabulary is updated to obtain the second API vocabulary; wherein, the first API vocabulary is the API vocabulary obtained during the previous model training. The API sequence samples in the training set are dimensionality reduced using the principal component analysis longitudinal dimensionality reduction algorithm to generate API sequence training samples. The API sequence samples in the validation set are dimensionality reduced using the principal component analysis longitudinal dimensionality reduction algorithm to generate API sequence validation samples. The API sequence training samples and API sequence verification samples are vectorized respectively to obtain their respective second training sample vectors and second verification sample vectors.

7. An update device for a malicious program detection model, characterized in that, include: The program detection module is used to detect the probability value of a target program sample being malicious through a malicious program detection model; The training set update module is used to add the API sequence corresponding to the target program sample to the training set when the probability value is lower than a preset probability threshold; the API sequence samples in the training set include the API sequences corresponding to the target program sample and multiple pre-existing malicious program samples. The validation set update module is used to cluster the API sequence samples in the training set using a density clustering algorithm, and to extract samples from each cluster to obtain the validation set. The model update module is used to train and update the malicious program detection model based on the training set and the validation set. During the initial model training, the model update module is also used for: The API sequence samples in the training set are vectorized based on the pre-trained initial API lexicon to obtain the first training sample vector; The API sequence samples in the verification set are vectorized according to the initial API lexicon to obtain the first verification sample vector; The preset text convolutional neural network is trained based on the first training sample vector and the first verification sample vector. The trained text convolutional neural network is used as the malware detection model.

8. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for performing the method described in any one of claims 1-6.

Images