Malicious code detection system training method and device, electronic equipment and storage medium

Abstract

The present disclosure discloses a malicious code detection system training method and device, an electronic device and a storage medium, and relates to the field of information processing. The main technical scheme comprises: obtaining a second training malicious code sample based on a first training detection model; labeling the obtained second training malicious code sample, and updating a third training malicious code sample using the same; repeatedly obtaining the second training malicious code sample, iteratively updating the third training malicious code sample, and using the latest third training malicious code sample to train the first training detection model; and obtaining a preset detection model when a training termination condition is met. Compared with related technologies, the second training malicious code sample is repeatedly obtained, the third training malicious code sample is iteratively updated, the latest third training malicious code sample is used to train the first training detection model, and then a malicious code detection system based on a deep learning method and providing a dynamic labeling function of a training sample is obtained.

Description

Technical Field

[0001] This disclosure relates to the field of information processing, and in particular to a method and apparatus for training a malicious code detection system, an electronic device, and a storage medium. Background Technology

[0002] Traditional manual detection methods involve submitting malware samples to cybersecurity experts for analysis. These experts then use their knowledge to detect different types of malware. While this method boasts high accuracy, it cannot effectively handle the detection of millions of malware samples. To address this challenge, inspired by the widespread application of machine learning and deep learning methods in fields such as machine vision and natural language processing, industry and academia have introduced these two approaches into the field of malware detection, ushering in a new era of automated malware detection.

[0003] However, both of these detection methods require training with a training set consisting of labeled malware samples. Their detection performance is directly related to the quality of the training set, and the selection criteria for training samples change as the model progresses through different training stages. Furthermore, accurate labeling of each training sample requires manual work by cybersecurity experts. Submitting only samples with more informational value for the current model training would undoubtedly yield a higher-performance detection system with a fixed labeling cost. Currently, some researchers have designed malware detection systems based on dynamic labeling of training samples using machine learning methods. However, machine learning, compared to deep learning, suffers from lower input feature dimensionality, information loss during the original feature mapping process, and the need for expert support. Applying effective information content evaluation criteria for machine learning methods directly to deep learning methods yields poor results.

[0004] Currently, there is no malware detection system based on deep learning methods that provides dynamic annotation of training samples. Therefore, designing a malware detection system based on deep learning methods and providing dynamic annotation of training samples is an urgent problem to be solved. Summary of the Invention

[0005] This disclosure provides a training method, apparatus, electronic device, and storage medium for a malware detection system. Its main purpose is to address the lack of malware detection systems based on deep learning methods that provide dynamic annotation of training samples in the relevant technologies.

[0006] According to a first aspect of this disclosure, a method for training a malicious code detection system is provided, comprising:

[0007] The first training malware sample is input into the first training detection model to obtain a second training malware sample with high information content but no annotation.

[0008] The second training malware sample is labeled;

[0009] The third training malicious code sample is updated using the labeled second training malicious code sample, which is the malicious code sample used to train the second training detection model;

[0010] The first training detection model is trained using the updated third malicious code sample. The second training malicious code sample is repeatedly obtained based on the first training detection model, and the third training malicious code sample is iteratively updated so that the first training detection model is trained using the latest third training malicious code sample.

[0011] Once the training termination condition is met, the first trained detection model is determined as the preset detection model.

[0012] Optionally, before inputting the first training malware sample into the first training detection model, the method further includes:

[0013] Construct a second training and detection model based on a deep learning model;

[0014] The loading of the second training detection model is completed by transferring the pre-trained parameters of the already trained model with the same structure to the second training detection model.

[0015] Based on the state of the malicious code samples used for training on the second training detection model, the information content of each malicious code sample is calculated.

[0016] The third training malicious code sample is obtained by labeling a preset number of malicious code samples that meet the preset high information content standard in a preset category.

[0017] The second training detection model is trained using a third training malware sample to obtain the first training detection model.

[0018] Optionally, the step of inputting the first training malicious code sample into the first training detection model to obtain an unlabeled second training malicious code sample with high information content related to the first training malicious code sample includes:

[0019] Input the first malicious code training sample into the first training detection model;

[0020] Calculate the gradient vector of each sample in the first malicious code training sample relative to each parameter of the last fully connected layer in the first training detection model;

[0021] Cluster the samples based on the gradient vector;

[0022] The sample closest to the centroid of each cluster among various types of malicious code is determined as the second training malicious code sample.

[0023] Optionally, updating the third training malicious code sample using the annotated second training malicious code sample includes:

[0024] The labeled second training malicious code sample is merged with the third training malicious code sample to complete the update of the third training malicious code sample.

[0025] Optionally, the step of training the first training detection model using the updated third malicious code sample, repeatedly obtaining the second training malicious code sample based on the first training detection model, iteratively updating the third training malicious code sample, and training the first training detection model using the latest third training malicious code sample includes:

[0026] If each third training malware sample is iteratively updated, the detection performance of the first training detection model is corrected based on the latest third training malware sample.

[0027] Optionally, determining the first trained detection model as a preset detection model after the training termination condition is met includes:

[0028] If the training of the first training detection model reaches the preset training termination condition, then training will stop.

[0029] The first training detection model obtained is determined as the preset detection model.

[0030] According to a second aspect of this disclosure, a training apparatus for a malicious code detection system is provided, comprising:

[0031] The input unit is used to input the first training malicious code sample into the first training detection model to obtain a second training malicious code sample with high information content but without annotation, which is related to the first training malicious code sample.

[0032] The first annotation unit is used to annotate the second training malicious code sample;

[0033] The update unit is used to update the third training malicious code sample using the labeled second training malicious code sample, wherein the third training malicious code sample is the malicious code sample used to train the second training detection model.

[0034] The first training unit is used to train the first training detection model using the updated third malicious code sample, repeatedly obtain the second training malicious code sample based on the first training detection model, and iteratively update the third training malicious code sample so as to train the first training detection model using the latest third training malicious code sample.

[0035] The determining unit is used to determine the first training detection model as the preset detection model when the training termination condition is met.

[0036] Optionally, the device further includes:

[0037] The building unit is used to construct a second training and detection model based on a deep learning model;

[0038] The transfer unit is used to load the second training detection model by transferring the pre-trained parameters of the already trained model with the same structure to the second training detection model.

[0039] The acquisition unit is used to pre-acquire malicious code samples that have been labeled with high information content;

[0040] The generation unit is used to divide the labeled high-information-content malicious code samples into preset categories and generate a third training malicious code sample.

[0041] The second training unit is used to train the second training detection model based on the third training malicious code sample to obtain the first training detection model.

[0042] Optionally, the input unit includes:

[0043] The input module is used to input the first malicious code training sample into the first training detection model;

[0044] The calculation module is used to calculate the gradient vector of each sample in the first malicious code training sample relative to each parameter of the last fully connected network in the first training detection model;

[0045] A clustering module is used to cluster the samples based on the gradient vector;

[0046] The determination module is used to identify the sample closest to the centroid of each cluster among various types of malicious code as the second training malicious code sample.

[0047] Optionally, the updating unit is further configured to merge the labeled second training malicious code sample with the third training malicious code sample to complete the update of the third training malicious code sample.

[0048] Optionally, the first training unit is further configured to, when each pair of third training malicious code samples is iteratively updated, correct the detection performance of the first training detection model based on the latest third training malicious code sample.

[0049] Optionally, the determining unit includes:

[0050] The stop module stops training when the training of the first training detection model reaches the preset training termination condition.

[0051] The determination module is used to determine the obtained first training detection model as the preset detection model.

[0052] According to a third aspect of this disclosure, an electronic device is provided, comprising:

[0053] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method described in the first aspect above.

[0054] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the method described in the first aspect above.

[0055] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described in the first aspect above.

[0056] The malicious code detection system training method, apparatus, electronic device, and storage medium disclosed herein involve inputting a first training malicious code sample into a first training detection model to obtain a second training malicious code sample with high information content but no annotation; annotating the second training malicious code sample; updating a third training malicious code sample using the annotated second training malicious code sample, wherein the third training malicious code sample is the malicious code sample used to train the second training detection model; training the first training detection model using the updated third malicious code sample; repeatedly acquiring the second training malicious code sample based on the first training detection model and iteratively updating the third training malicious code sample to train the first training detection model using the latest third training malicious code sample; and determining the first training detection model as a preset detection model when the training termination condition is met. Compared with related technologies, the embodiments of this disclosure, by repeatedly acquiring the second training malicious code sample based on the first training detection model and iteratively updating the third training malicious code sample to train the first training detection model using the latest third training malicious code sample, improves the detection performance of the first training detection model, and finally obtains a preset detection model, thereby obtaining a malicious code detection system based on deep learning methods and providing dynamic annotation function for training samples.

[0057] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description.

[0058] Solving technical problems + technical solutions + beneficial effects Attached Figure Description

[0059] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0060] Figure 1 This is a flowchart illustrating a training method for a malicious code detection system provided in an embodiment of this disclosure.

[0061] Figure 2 This is a flowchart illustrating an iterative training method for a malicious code detection system provided in an embodiment of this disclosure.

[0062] Figure 3 A flowchart illustrating another training method for a malicious code detection system provided in this disclosure;

[0063] Figure 4 This is a schematic diagram of the structure of a training device for a malicious code detection system provided in this disclosure;

[0064] Figure 5A schematic diagram of the structure of another malicious code detection system training device provided in this disclosure;

[0065] Figure 6 A schematic block diagram of an example electronic device 400 that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation

[0066] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0067] The following description, with reference to the accompanying drawings, outlines an embodiment of a malicious code detection system training method, apparatus, electronic device, and storage medium.

[0068] Figure 1 This is a flowchart illustrating a training method for a malicious code detection system provided in an embodiment of this disclosure. Figure 1 As shown, the method includes the following steps:

[0069] Step 101: Input the first training malicious code sample into the first training detection model to obtain a second training malicious code sample with high information content but without annotation, which is related to the first training malicious code sample.

[0070] Before inputting the first training malicious code sample into the first training detection model, the first training malicious code sample is preprocessed to obtain the processed first training malicious code sample. The first training malicious code sample is a malicious code sample that has not been clustered and screened and is to be labeled.

[0071] In order to obtain high-information-content malware samples from the first training malware sample, this disclosure provides a possible implementation: based on a first training detection model with certain clustering and screening capabilities, high-information-content malware samples are selected from the first training malware sample to form a second training malware sample.

[0072] Step 102: Label the second training malicious code sample.

[0073] The second training malicious code sample obtained based on the first training detection model has not yet been labeled.

[0074] In order to use the obtained second training malicious code sample to train the first training detection model, the second training malicious code sample needs to be labeled by cybersecurity experts. This embodiment of the disclosure does not limit the specific labeling method.

[0075] Step 103: Update the third training malicious code sample using the labeled second training malicious code sample, wherein the third training malicious code sample is the malicious code sample used to train the second training detection model.

[0076] The second training detection model is built on a convolutional neural network. The first training detection model is obtained by training the second training detection model with a third training malicious code sample that has been labeled and has a preset number of categories.

[0077] The third training malware sample was obtained by cybersecurity experts through analysis and labeling of a preset number of malware samples from different categories.

[0078] In order to reconstruct the third training malicious code sample, this disclosure provides a possible implementation: merging the obtained second training malicious code sample with the third malicious code sample to construct a new third training malicious code sample, thereby completing the update of the third training malicious code sample.

[0079] Step 104: Train the first training detection model using the updated third malicious code sample, repeatedly obtain the second training malicious code sample based on the first training detection model, iteratively update the third training malicious code sample, so as to train the first training detection model using the latest third training malicious code sample.

[0080] In order to improve the performance of the first training detection model, this embodiment of the disclosure will repeatedly acquire a second training malicious code sample with high information content based on the first training detection model, and then iteratively update the third training malicious code sample.

[0081] Each time the third training malware sample is iterated and updated, the detection performance of the first training detection model is corrected based on the latest third training malware sample. Through repeated corrections, the detection performance of the first training detection model is improved.

[0082] The first training detection model repeatedly acquires the second training malicious code sample. That is, after training the first training detection model with the latest third training malicious code sample, the first training detection model acquires the second training malicious code sample again to update the latest third training malicious code sample.

[0083] Step 105: When the training termination condition is met, the first training detection model is determined as the preset detection model.

[0084] As can be seen from step 104, before the first training detection model is determined as the preset detection model, the third training malicious code sample that needs to be iteratively updated needs to be trained multiple times in order to improve the detection performance of the first training detection model.

[0085] To obtain a preset detection model that meets preset standards, this disclosure specifies that a first training detection model that meets training termination conditions is determined as the preset detection model. These termination conditions include, for example: the detection accuracy of the second training detection model reaches a preset threshold, thus terminating training; or the total number of labeled malicious code samples used to train the second training detection model reaches a preset threshold, thus terminating training. It should be understood that the examples of training termination conditions in this disclosure are merely illustrative, and this disclosure does not limit the specific training termination conditions.

[0086] To more intuitively demonstrate the iterative training process of the first training detection model in the embodiments of this application, Figure 2 This is a flowchart illustrating an iterative training method for a malicious code detection system provided in an embodiment of this disclosure, as shown below. Figure 2 As shown, based on the first trained detection model, the second trained malware sample is repeatedly obtained, and the third trained malware sample is iteratively updated, so that the first trained detection model is trained using the latest third trained malware sample.

[0087] The malicious code detection system training method disclosed herein involves inputting a first training malicious code sample into a first training detection model to obtain a second training malicious code sample with high information content but no annotation; annotating the second training malicious code sample; updating a third training malicious code sample using the annotated second training malicious code sample, wherein the third training malicious code sample is the malicious code sample used to train the second training detection model; training the first training detection model using the updated third malicious code sample; repeatedly acquiring the second training malicious code sample based on the first training detection model and iteratively updating the third training malicious code sample to train the first training detection model using the latest third training malicious code sample; and determining the first training detection model as a preset detection model when the training termination condition is met. Compared with related technologies, the embodiments of this disclosure, by repeatedly acquiring the second training malicious code sample based on the first training detection model and iteratively updating the third training malicious code sample to train the first training detection model using the latest third training malicious code sample, improves the detection performance of the first training detection model, and finally obtains a preset detection model, thereby obtaining a malicious code detection system based on deep learning methods and providing dynamic annotation function for training samples.

[0088] Figure 3 This is a flowchart illustrating another method for training a malicious code detection system provided in this embodiment of the disclosure. Figure 3 As shown, the method includes the following steps:

[0089] Step 201: Construct a second training and detection model based on a deep learning model.

[0090] A second training and detection model is constructed based on a convolutional neural network, which consists of multiple convolutional layers, pooling layers, and fully connected layers.

[0091] Step 202: The second training detection model is loaded by transferring the pre-trained parameters of the already trained model with the same structure to the second training detection model.

[0092] To achieve rapid training of the second training detection model and enable it to possess certain detection capabilities, this embodiment employs transfer learning and initialization training methods. For example, the second training detection model is loaded with pre-trained parameters of a model with the same structure trained on the ImageNet machine vision training set, allowing it to perform basic detection. This embodiment does not limit the specific training method.

[0093] Step 203: Pre-acquire a sample of malicious code with high information content that has been labeled.

[0094] The labeled high-information-content malicious code samples were selected and labeled by cybersecurity experts.

[0095] Step 204: Divide the labeled high-information-content malicious code samples into preset categories to generate a third training malicious code sample.

[0096] The labeled high-information-content malicious code samples obtained in step 203 are classified according to preset categories to finally generate the third training malicious code sample.

[0097] For example, if the preset category is N, then the labeled high-information-content malicious code samples are divided into N categories. Specifically, this disclosure does not limit this aspect.

[0098] Step 205: Train the second training detection model based on the third training malicious code sample to obtain the first training detection model.

[0099] To improve the training effect of high-information-content malicious code samples on the second training detection model, this disclosure provides a method, for example: converting each byte (0x00-FF) of the high-information-content malicious code sample in hexadecimal representation into a value of 0-255, using it as the grayscale value of the pixel, and arranging them one by one into a 224x224 grayscale image. Converting the high-information-content malicious code sample into a grayscale image for training the second training detection model improves the training effect.

[0100] To obtain a second detection model with better detection performance, a third training malicious code sample is used to train and optimize the second training detection model, thereby obtaining the first training detection model.

[0101] As a refinement of the embodiments of this disclosure, when step 101 is executed to input the first training malicious code sample into the first training detection model to obtain the second training malicious code sample with unlabeled high information content related to the first training malicious code sample, the following implementation methods can be adopted, for example: inputting the first malicious code training sample into the first training detection model; calculating the gradient vector of each sample in the first malicious code training sample relative to each parameter of the last fully connected network in the first training detection model; clustering each sample according to the gradient vector; and determining the sample closest to the centroid of each cluster among the malicious codes of each type as the second training malicious code sample.

[0102] To more clearly illustrate the process of obtaining the second training malware sample, this disclosure provides an example: A first training malware sample is input, which is a malware sample to be labeled but not yet clustered. The gradient vector of each sample in the first training malware sample relative to the parameters of the last fully connected layer in the first training detection model is calculated. Clustering is performed based on the gradient vectors. The clustering categories are preset during the construction of the second training detection model, assumed to be N categories. The first training malware sample is clustered into N categories based on the gradient vectors. The malware sample closest to the centroid of each cluster is identified as a high-information malware sample, resulting in N high-information malware samples, which are then combined to form the second training malware sample. Specifically, this disclosure does not limit the scope of the example.

[0103] As a refinement of the above embodiments, when the first training detection model is trained using the updated third malicious code sample in step 104, and the second training malicious code sample is repeatedly obtained based on the first training detection model, and the third training malicious code sample is iteratively updated so as to train the first training detection model using the latest third training malicious code sample, the following implementation methods can be adopted, but are not limited to: for example, if the detection performance of the first training detection model is corrected once based on the latest third training malicious code sample after each iterative update of the third training malicious code sample.

[0104] As a refinement of the above embodiments, when the first training detection model is determined as the preset detection model after the training termination condition is met in step 105, the following implementation methods can be adopted, but are not limited to: if the training of the first training detection model reaches the preset training termination condition, then the training is stopped; and the obtained first training detection model is determined as the preset detection model.

[0105] In summary, the embodiments disclosed herein achieve the following effects:

[0106] 1. In this embodiment, the first training detection model is repeatedly used to obtain the second training malicious code sample and iteratively update the third training malicious code sample. The first training detection model is then trained using the latest third training malicious code sample to improve its detection performance. Finally, a preset detection model is obtained, which in turn provides a malicious code detection system based on deep learning methods and provides dynamic annotation of training samples.

[0107] 2. Based on the first training detection model, the second training malicious code sample is repeatedly obtained, and the third training malicious code sample is iteratively updated so as to use the latest third training malicious code sample to train the first training detection model, thereby realizing iterative training of the first training detection model and improving the detection performance of the first training detection model.

[0108] 3. By transferring the pre-trained parameters of the already trained model with the same structure to the second training detection model, the loading of the second training detection model is completed, realizing the rapid configuration of the second training detection model and the generation of its basic functions.

[0109] Corresponding to the above-described method for updating the code detection model, this invention also proposes a training device for a malicious code detection system. Since the device embodiments of this invention correspond to the method embodiments described above, details not disclosed in the device embodiments can be referred to in the method embodiments, and will not be repeated here.

[0110] Figure 4 This is a schematic diagram of the structure of a training device for a malicious code detection system provided in this disclosure.

[0111] This invention also proposes a training device for a malicious code detection system. Figure 4 As shown, it includes:

[0112] Input unit 31 is used to input the first training malicious code sample into the first training detection model to obtain a second training malicious code sample with high information content but no labeling related to the first training malicious code sample.

[0113] The first annotation unit 32 is used to annotate the second training malicious code sample;

[0114] Update unit 33 is used to update the third training malicious code sample using the labeled second training malicious code sample, wherein the third training malicious code sample is the malicious code sample used to train the second training detection model;

[0115] The first training unit 34 is used to train the first training detection model using the updated third malicious code sample, repeatedly obtain the second training malicious code sample based on the first training detection model, and iteratively update the third training malicious code sample so as to train the first training detection model using the latest third training malicious code sample.

[0116] The determining unit 35 is used to determine the first training detection model as the preset detection model when the training termination condition is met.

[0117] The malicious code detection system training apparatus provided in this disclosure inputs a first training malicious code sample into a first training detection model to obtain a second training malicious code sample with high information content but no annotation. The second training malicious code sample is then annotated. The annotated second training malicious code sample is used to update a third training malicious code sample, which is the malicious code sample used to train the second training detection model. The updated third malicious code sample is used to train the first training detection model. Based on the first training detection model, the second training malicious code sample is repeatedly acquired, and the third training malicious code sample is iteratively updated to train the first training detection model using the latest third training malicious code sample. When the training termination condition is met, the first training detection model is determined as a preset detection model. Compared with related technologies, this embodiment of the disclosure repeatedly acquires the second training malicious code sample based on the first training detection model and iteratively updates the third training malicious code sample to train the first training detection model using the latest third training malicious code sample, thereby improving the detection performance of the first training detection model and finally obtaining a preset detection model. This results in a malicious code detection system based on deep learning methods that provides dynamic annotation of training samples.

[0118] Furthermore, in one possible implementation of this embodiment, such as Figure 5 As shown, Figure 5 This is a schematic diagram of another malicious code detection system training device provided in this disclosure, the device further includes:

[0119] Building unit 36 ​​is used to build a second training detection model based on a deep learning model;

[0120] The transfer unit 37 is used to load the second training detection model by transferring the pre-trained parameters of the already trained model with the same structure to the second training detection model.

[0121] Acquisition unit 38 is used to pre-acquire malicious code samples that have been labeled with high information content;

[0122] The generation unit 39 is used to divide the labeled high-information-content malicious code samples into preset categories and generate a third training malicious code sample.

[0123] The second training unit 310 is used to train the second training detection model based on the third training malicious code sample to obtain the first training detection model.

[0124] Furthermore, in one possible implementation of this embodiment, such as Figure 5 As shown, the input unit 31 includes:

[0125] Input module 311 is used to input the first malicious code training sample into the first training detection model;

[0126] The calculation module 312 is used to calculate the gradient vector of each sample in the first malicious code training sample relative to each parameter of the last fully connected network in the first training detection model;

[0127] Clustering module 313 is used to cluster each sample according to the gradient vector;

[0128] The determination module 314 is used to determine the sample that is closest to the centroid of each cluster among various types of malicious code as the second training malicious code sample.

[0129] Furthermore, in one possible implementation of this embodiment, such as Figure 5 As shown, the update unit 33 is further configured to merge the labeled second training malicious code sample with the third training malicious code sample to complete the update of the third training malicious code sample.

[0130] Furthermore, in one possible implementation of this embodiment, such as Figure 5 As shown, the first training unit 34 is also used to correct the detection performance of the first training detection model based on the latest third training malicious code sample when each pair of third training malicious code samples is iteratively updated.

[0131] Furthermore, in one possible implementation of this embodiment, such as Figure 5 As shown, the determining unit 35 includes:

[0132] Stop module 351 stops training when the training of the first training detection model reaches the preset training termination condition;

[0133] The determination module 352 is used to determine the obtained first training detection model as the preset detection model.

[0134] It should be noted that the foregoing explanation of the method embodiments also applies to the apparatus of this embodiment, and the principle is the same, so it is not limited in this embodiment.

[0135] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0136] Figure 6A schematic block diagram of an example electronic device 400 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0137] like Figure 6 As shown, device 400 includes a computing unit 401, which can perform various appropriate actions and processes based on a computer program stored in ROM (Read-Only Memory) 402 or a computer program loaded from storage unit 408 into RAM (Random Access Memory) 403. RAM 403 may also store various programs and data required for the operation of device 400. The computing unit 401, ROM 402, and RAM 403 are interconnected via bus 404. I / O (Input / Output) interface 405 is also connected to bus 404.

[0138] Multiple components in device 400 are connected to I / O interface 405, including: input unit 406, such as keyboard, mouse, etc.; output unit 407, such as various types of monitors, speakers, etc.; storage unit 408, such as disk, optical disk, etc.; and communication unit 409, such as network card, modem, wireless transceiver, etc. Communication unit 409 allows device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0139] The computing unit 401 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, CPUs (Central Processing Units), GPUs (Graphics Processing Units), various special-purpose AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, DSPs (Digital Signal Processors), and any suitable processor, controller, microcontroller, etc. The computing unit 401 performs the various methods and processes described above, such as methods for detecting abnormal medical behavior. For example, in some embodiments, methods for detecting abnormal medical behavior may be implemented as computer software programs tangibly contained in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by the computing unit 401, one or more steps of the methods described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to perform the aforementioned method for detecting abnormal diagnostic and treatment behaviors by any other suitable means (e.g., by means of firmware).

[0140] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application-Specific Standard Products), SOCs (System-on-Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0141] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0142] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, EPROM (Electrically Programmable Read-Only Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0143] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0144] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include LANs (Local Area Networks), WANs (Wide Area Networks), the Internet, and blockchain networks.

[0145] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service ecosystem, addressing the shortcomings of traditional physical hosts and VPS (Virtual Private Server, or simply "VPS") services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0146] It's important to note that artificial intelligence (AI) is the study of enabling computers to simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). It encompasses both hardware and software technologies. AI hardware technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily include computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graph technologies.

[0147] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0148] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A training method for a malicious code detection system, characterized in that, include: The first training malware sample is input into the first training detection model to obtain a second training malware sample with high information content but no annotation. The second training malware sample is labeled; The third training malicious code sample is updated using the labeled second training malicious code sample, which is the malicious code sample used to train the second training detection model; The first training detection model is trained using the updated third malicious code sample. The second training malicious code sample is repeatedly obtained based on the first training detection model, and the third training malicious code sample is iteratively updated so that the first training detection model is trained using the latest third training malicious code sample. Once the training termination condition is met, the first training detection model is determined as the preset detection model. The step of inputting the first training malware sample into the first training detection model to obtain a second training malware sample with high information content but no annotation includes: Input the first malicious code training sample into the first training detection model; Calculate the gradient vector of each sample in the first malicious code training sample relative to each parameter of the last fully connected layer in the first training detection model; Cluster the samples based on the gradient vector; The sample closest to the centroid of each cluster among various types of malicious code is determined as the second training malicious code sample.

2. The training method according to claim 1, characterized in that, Before inputting the first training malware sample into the first training detection model, the method further includes: Construct a second training and detection model based on a deep learning model; The loading of the second training detection model is completed by transferring the pre-trained parameters of the already trained model with the same structure to the second training detection model. Pre-acquire highly informative malicious code samples that have been labeled; The labeled high-information-content malicious code samples are divided into preset categories to generate a third training malicious code sample. The second training detection model is trained based on the third training malicious code sample to obtain the first training detection model.

3. The training method according to claim 1, characterized in that, The step of updating the third training malware sample using the annotated second training malware sample includes: The labeled second training malicious code sample is merged with the third training malicious code sample to complete the update of the third training malicious code sample.

4. The training method according to claim 1, characterized in that, The step of training the first training detection model using the updated third malicious code sample, repeatedly obtaining the second training malicious code sample based on the first training detection model, iteratively updating the third training malicious code sample, and training the first training detection model using the latest third training malicious code sample includes: If each third training malware sample is iteratively updated, the detection performance of the first training detection model is corrected based on the latest third training malware sample.

5. The training method according to claim 1, characterized in that, The step of determining the first training detection model as the preset detection model after the training termination condition is met includes: If the training of the first training detection model reaches the preset training termination condition, then training will stop. The first training detection model obtained is determined as the preset detection model.

6. A training device for a malicious code detection system, characterized in that, include: The input unit is used to input the first training malicious code sample into the first training detection model to obtain a second training malicious code sample with high information content but without annotation, which is related to the first training malicious code sample. The first annotation unit is used to annotate the second training malicious code sample; The update unit is used to update the third training malicious code sample using the labeled second training malicious code sample, wherein the third training malicious code sample is the malicious code sample used to train the second training detection model. The first training unit is used to train the first training detection model using the updated third malicious code sample, repeatedly obtain the second training malicious code sample based on the first training detection model, and iteratively update the third training malicious code sample so as to train the first training detection model using the latest third training malicious code sample. The determining unit is used to determine the first training detection model as the preset detection model when the training termination condition is met. The input unit includes: The input module is used to input the first malicious code training sample into the first training detection model; The calculation module is used to calculate the gradient vector of each sample in the first malicious code training sample relative to each parameter of the last fully connected network in the first training detection model; A clustering module is used to cluster the samples based on the gradient vector; The determination module is used to identify the sample closest to the centroid of each cluster among various types of malicious code as the second training malicious code sample.

7. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-5.

8. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-5.

9. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method according to any one of claims 1-5.

Images