A model training method, device, equipment and readable storage medium

Abstract

This application discloses a model training method, apparatus, device, and readable storage medium. The method includes: training a hybrid feature model using a mixed PE file set containing multiple types as a training set; training a target feature model using a target PE file set including a specific type as a training set; determining the invalid feature dimensions corresponding to the hybrid feature model and replacing the invalid feature dimensions with the target feature dimensions corresponding to the target feature model to obtain a fused feature model; and training a file detection model based on the hybrid PE file set and the fused feature model. This application removes invalid features from the general feature model without changing its dimensions, while adding new features, thereby training a file detection model while saving engine space and resource overhead. The model training apparatus, device, and readable storage medium provided in this application also have the above-mentioned technical effects.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a model training method, apparatus, device, and readable storage medium. Background Technology

[0002] Currently, general file detection models remove features from special types of PE files, making it impossible to detect viruses in these specific PE file types. To perform virus detection on special types of PE files, a separate file detection model needs to be trained based on these specific types of PE files, which increases engine space and resource overhead.

[0003] Therefore, how to train a file detection model for special types of PE files while saving engine space and resource consumption is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a model training method, apparatus, device, and readable storage medium to train a file detection model for special types of PE files while saving engine space and resource overhead. The specific solution is as follows:

[0005] Firstly, this application provides a model training method, including:

[0006] A hybrid feature model was trained using a mixed set of PE files of various types as the training set.

[0007] A target feature model is trained using a set of target PE files of a specific type as the training set.

[0008] The invalid feature dimension corresponding to the hybrid feature model is determined, and the invalid feature dimension is replaced by the target feature dimension corresponding to the target feature model to obtain the fused feature model;

[0009] A file detection model is trained based on the hybrid PE file set and the fusion feature model.

[0010] Preferably, determining the invalid feature dimension corresponding to the hybrid feature model includes:

[0011] The hybrid feature model is used to vectorize a set of verification files that combine multiple types.

[0012] The vectorized processing results of the verification file set are classified using a classification algorithm to obtain the classification results;

[0013] Feature dimensions that do not contribute to the classification results are identified as invalid feature dimensions.

[0014] Preferably, the classification of the vectorized processing results of the verification document set using a classification algorithm to obtain the classification results includes:

[0015] The vectorized processing results of the verification file set are classified using the XGBOOST algorithm, random forest algorithm, or contribution evaluation algorithm to obtain the classification results.

[0016] Preferably, the step of replacing the invalid feature dimension with the target feature dimension corresponding to the target feature model to obtain the fused feature model includes:

[0017] Delete the feature data in the invalid feature dimension, and retain the dimension index of the invalid feature dimension;

[0018] The feature data in the target feature dimension is mapped to the dimension number to obtain the fused feature model.

[0019] Preferably, mapping the feature data in the target feature dimension to the dimension index includes:

[0020] Establish a mapping table between the feature data in the target feature dimension and the dimension index;

[0021] Based on the mapping table, the feature data in the target feature dimension is filled into the dimension number.

[0022] Preferably, the step of training the file detection model based on the hybrid PE file set and the fused feature model includes:

[0023] The hybrid feature model is used to vectorize the hybrid PE file set;

[0024] The file detection model is trained using the vectorized processing results of the hybrid PE file set as the training set.

[0025] Preferably, it further includes:

[0026] Obtain the target file to be detected;

[0027] The target file is vectorized using the hybrid feature model.

[0028] Virus detection is performed on the vectorized processing results of the target file using the file detection model.

[0029] Secondly, this application provides a model training apparatus, comprising:

[0030] The first training module is used to train a hybrid feature model using a mixed set of PE files of multiple types as the training set.

[0031] The second training module is used to train a target feature model using a set of target PE files of a specific type as the training set.

[0032] The fusion module is used to determine the invalid feature dimension corresponding to the hybrid feature model, and replace the invalid feature dimension with the target feature dimension corresponding to the target feature model to obtain the fused feature model;

[0033] The third training module is used to train a file detection model based on the hybrid PE file set and the fusion feature model.

[0034] Thirdly, this application provides an electronic device, comprising:

[0035] Memory, used to store computer programs;

[0036] A processor for executing the computer program to implement the aforementioned disclosed model training method.

[0037] Fourthly, this application provides a readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned disclosed model training method.

[0038] As can be seen from the above scheme, this application provides a model training method, including: using a mixed PE file set containing multiple types as a training set to train a mixed feature model; using a target PE file set including a specific type as a training set to train a target feature model; determining the invalid feature dimension corresponding to the mixed feature model, and replacing the invalid feature dimension with the target feature dimension corresponding to the target feature model to obtain a fused feature model; and training a file detection model based on the mixed PE file set and the fused feature model.

[0039] As can be seen, this application first uses a mixed PE file set containing multiple types as the training set to train a mixed feature model; then, it uses a target PE file set including a specific type as the training set to train a target feature model; next, it identifies the invalid feature dimensions corresponding to the mixed feature model and replaces the invalid feature dimensions with the target feature dimensions corresponding to the target feature model, thus obtaining a fused feature model; finally, it trains a file detection model based on the mixed PE file set and the fused feature model. Here, the mixed feature model is a feature model covering general-type PE files, and the target feature model is a feature model covering a specific type of PE file. Therefore, by replacing the invalid feature dimensions corresponding to the mixed feature model with the target feature dimensions corresponding to the target feature model, the feature model for a specific type of PE file can be fused with the feature model for general-type PE files, thus obtaining a fused feature model covering both general-type and specific-type PE files. Finally, a file detection model covering both general-type and specific-type PE files can be trained based on the mixed PE file set and the fused feature model, thus avoiding the need to train a separate file detection model based on a specific type of PE file, thereby saving engine space and resource overhead. This application only requires fusing a general feature model with a specific type feature model to train a file detection model covering both general-type PE files and a specific type of PE file. Without changing the dimensions of the general feature model, invalid features are removed, and new features are added, thus improving the model's detection capability. In other words, while saving engine space and resource overhead, corresponding file detection models are trained for both specific and general-type PE files.

[0040] Correspondingly, the model training device, equipment, and readable storage medium provided in this application also have the above-mentioned technical effects. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0042] Figure 1 This is a flowchart of a model training method disclosed in this application;

[0043] Figure 2 This is a flowchart illustrating the usage process of a document detection model disclosed in this application;

[0044] Figure 3This is a flowchart of another model training method disclosed in this application;

[0045] Figure 4 This is a schematic diagram of a model training device disclosed in this application;

[0046] Figure 5 This is a schematic diagram of an electronic device disclosed in this application;

[0047] Figure 6 This is a schematic diagram of another electronic device disclosed in this application. Detailed Implementation

[0048] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0049] Currently, general file detection models remove features specific to certain PE file types, making them incapable of detecting viruses in these types of PE files. To perform virus detection on specific PE file types, a separate file detection model needs to be trained for each type, increasing engine space and resource overhead. Therefore, this application provides a model training scheme that can train a file detection model specifically for certain PE file types while saving engine space and resource overhead.

[0050] See Figure 1 As shown in the embodiments of this application, a model training method is disclosed, including:

[0051] S101. Using a mixed set of PE files of various types as the training set, a mixed feature model is trained.

[0052] PE (Portable Executable) files are portable executable files. Common examples include EXE, DLL, OCX, SYS, COM, and .NET files. PE files are program files on the Microsoft Windows operating system (they may be executed indirectly, such as through DLLs). A .NET file is an application written using the .NET Framework class library and running on the Common Language Runtime. The .NET Framework is a free and open-source development platform for building a wide variety of applications. It allows the development of web applications, web APIs and microservices, serverless functions in the cloud, cloud-native applications, mobile applications, desktop applications, Windows WPF, Windows Forms, Universal Windows Platform (UWP), games, Internet of Things (IoT), machine learning, console applications, and Windows services using various languages, editors, and libraries.

[0053] The mixed PE file set includes multiple types of PE files, with black and white files mixed together. The hybrid feature model can vectorize file information such as the file header and specific strings in the file of each PE file in the mixed PE file set, thereby vectorizing each PE file for detection and classification.

[0054] S102. Using a set of target PE files of a specific type as the training set, train the target feature model.

[0055] Correspondingly, the target PE file set includes multiple PE files belonging to a specific type (such as .NET), and these files are a mix of black and white files. The target feature model can vectorize file information such as the file header and specific strings in the files of each PE file in the target PE file set, thereby vectorizing each PE file to detect and classify multiple PE files of that specific type.

[0056] It should be noted that details regarding the model structure and training process of hybrid feature models and target feature models can be found in existing related technologies.

[0057] S103. Determine the invalid feature dimension corresponding to the hybrid feature model, and replace the invalid feature dimension with the target feature dimension corresponding to the target feature model to obtain the fused feature model.

[0058] Hybrid feature models can vectorize each PE file in a hybrid PE file set based on the trained feature dimensions. However, some feature dimensions may not be effective for file detection and classification. These feature dimensions are invalid feature dimensions, and the specific feature data in these feature dimensions are invalid feature data.

[0059] The target feature model can vectorize each PE file in the target PE file set based on the trained feature dimensions. Since the hybrid feature model has some invalid feature dimensions, the invalid feature dimensions corresponding to the hybrid feature model can be replaced with the valid target feature dimensions corresponding to the target feature model. This allows the feature model for a specific type of PE file to be fused with the feature model for a general type of PE file, resulting in a fused feature model that covers both general type PE files and a specific type of PE file.

[0060] S104. A file detection model is obtained by training a hybrid PE file set and a fusion feature model.

[0061] In one specific implementation, a file detection model is trained based on a hybrid PE file set and a fusion feature model, including: vectorizing the hybrid PE file set using the hybrid feature model; and training the file detection model using the vectorized result of the hybrid PE file set as the training set.

[0062] The feature dimensions corresponding to the fusion feature model include both the effective feature dimensions corresponding to the hybrid feature model and the target feature dimensions (i.e., the effective feature dimensions corresponding to the target feature model). Therefore, by using the fusion feature model to vectorize the hybrid PE file set, the special types of PE files in the hybrid PE file set can be represented, ensuring that the vectorized features of special types of PE files are not missed. Subsequently, using the vectorized processing results of the hybrid PE file set as the training set, a file detection model covering general-type PE files and a specific type of PE file can be trained.

[0063] In this embodiment, the hybrid feature model is a feature model covering general-type PE files, and the target feature model is a feature model covering a specific type of PE file. Therefore, by replacing the invalid feature dimensions corresponding to the hybrid feature model with the target feature dimensions corresponding to the target feature model, the feature model for a specific type of PE file and the feature model for general-type PE files can be fused, resulting in a fused feature model covering both general-type and specific-type PE files. Finally, a file detection model covering both general-type and specific-type PE files can be trained based on the hybrid PE file set and the fused feature model. This avoids training a separate file detection model based on a specific type of PE file, thus saving engine space and resource overhead.

[0064] As can be seen, this embodiment only requires fusing the general feature model and the specific type feature model to train a file detection model covering both general-type PE files and a specific type of PE file. Without changing the dimensions of the general feature model, invalid features are removed, and new features are added, thus improving the model's detection capability. In other words, while saving engine space and resource overhead, corresponding file detection models are trained for both specific and general-type PE files.

[0065] Based on the above embodiments, in one specific implementation, determining the invalid feature dimension corresponding to the hybrid feature model includes: using the hybrid feature model to vectorize the verification file set that mixes multiple types; using a classification algorithm to classify the vectorized processing result of the verification file set to obtain a classification result; and determining the feature dimension that does not play a role in the classification result as an invalid feature dimension.

[0066] The process involves classifying the vectorized results of the validation document set using classification algorithms, including: classifying the vectorized results of the validation document set using the XGBOOST algorithm, random forest algorithm, or contribution evaluation algorithm.

[0067] If the classification algorithm performs a binary classification problem, then the feature dimensions that do not contribute to the classification result are those that do not contribute to either the black or white classification. In other words, the contribution of these feature dimensions to either black or white classification is 0. The classification algorithm can be the XGBoost algorithm, the Random Forest algorithm, or a contribution evaluation algorithm. Of course, other algorithms can also be used. File detection models can be built based on classification algorithms.

[0068] Based on the above embodiments, in one specific implementation, the fused feature model is obtained by replacing the invalid feature dimension with the target feature dimension corresponding to the target feature model, including: deleting the feature data in the invalid feature dimension and retaining the dimension index of the invalid feature dimension; mapping the feature data in the target feature dimension to the dimension index to obtain the fused feature model.

[0069] The process of mapping feature data in the target feature dimension to dimension numbers includes: establishing a mapping table between feature data in the target feature dimension and dimension numbers; and filling the dimension numbers with feature data in the target feature dimension based on the mapping table.

[0070] When mapping feature data in the target feature dimension to dimension numbers, you can map them in order according to the dimension numbers or in random order.

[0071] Based on the above embodiments, in one specific implementation, the method further includes: a process for using the document detection model, which includes:

[0072] S201. Obtain the target file to be detected;

[0073] S202. Vectorize the target file using a hybrid feature model;

[0074] S203. Use the file detection model to perform virus detection on the vectorized processing results of the target file.

[0075] It should be noted that the hybrid feature model covers both general-type PE files and specific-type PE files. Therefore, regardless of whether the target file is a general-type PE file or a specific-type PE file, the hybrid feature model can vectorize it. Then, the file detection model can be used to detect viruses on the vectorized result of the target file, thereby determining whether the target file is a white file (i.e., a normal file) or a black file (i.e., a file carrying a virus).

[0076] See Figure 3 As shown in the embodiments of this application, another model training method is disclosed. This method requires training two feature models, then fusing the two feature models, and finally training a classification model (i.e., a file detection model) based on the fused feature model. The specific process includes:

[0077] (1) Collect ordinary black and white PE files as training data. The black and white samples collected for training the original model do not distinguish whether they are special types of PE files. Extract keywords (such as file header information, content strings, etc.) in the files as features to train a feature model. Then, use the feature model to vectorize the training data for subsequent training of the classification model.

[0078] (2) Feature selection

[0079] Using XGBOOST, contribution evaluation algorithm, or other feature importance selection algorithm, calculate the score of each feature of each file against the black and white attributes for each feature dimension. Sort the scores and take the feature dimension with 0 for both black and white as invalid feature dimension. Delete the data in these dimensions corresponding to the feature model obtained in (1), but retain the dimension number information.

[0080] (3) Training feature models for special file types

[0081] Collect black and white files of a special type (NET type is used as an example in this embodiment) to form a training set, use the feature dimension deleted in (2) as the feature dimension of the feature model to be trained, and train the feature model of the special type based on the current training set.

[0082] (4) Integrate the feature model in (3) with the feature model in (1).

[0083] Based on the dimension number information retained in (2), a mapping table is established between the feature model in (3) and the feature model in (1). The feature dimensions corresponding to the feature model in (3) are added to the feature model in (1), and the corresponding specific feature data is filled into the deleted invalid feature dimensions to achieve multi-topic fusion of the model and obtain the fused feature model.

[0084] (5) Retrain the classification model

[0085] Based on the training set data in (1) and the fusion feature model in (4), a classification model is trained to obtain a model that can effectively classify both special and general types of files.

[0086] As can be seen, this application reduces the dimensions of the general feature model and fills the reduced parts of the general feature model with the feature dimensions of special-type feature models through mapping. This embeds the dimensions of the special models into the original model, achieving multi-topic fusion. Based on this, a classification model is trained. Without changing the dimensions of the original model, invalid features in the original model are removed, while new features are added, thus improving the model's detection capability. It can solve the problem of inaccurate detection results for special-type files while maintaining compatibility with currently released engines, reducing unnecessary development and testing work, and without increasing the time, space, memory, and CPU overhead during the detection process. It also reduces engine code modifications required for model upgrades, optimizing a series of tasks such as testing and version upgrades. It achieves the detection of special-type files without changing the model structure, modifying the engine, or maintaining the original model's detection capabilities.

[0087] The following describes a model training apparatus provided in an embodiment of this application. The model training apparatus described below and the model training method described above can be referred to each other.

[0088] See Figure 4 As shown in the figure, this application discloses a model training device, including:

[0089] The first training module 401 is used to train a hybrid feature model using a mixed set of PE files of multiple types as the training set.

[0090] The second training module 402 is used to train a target feature model using a set of target PE files of a specific type as the training set.

[0091] The fusion module 403 is used to determine the invalid feature dimensions corresponding to the hybrid feature model and replace the invalid feature dimensions with the target feature dimensions corresponding to the target feature model to obtain the fused feature model.

[0092] The third training module 404 is used to train a file detection model based on a hybrid PE file set and a fusion feature model.

[0093] In one specific implementation, the fusion module includes:

[0094] Vectorization unit, used to vectorize a set of verification files of multiple types using a hybrid feature model;

[0095] The classification unit is used to classify the vectorized processing results of the validation document set using a classification algorithm to obtain the classification result;

[0096] The determination unit is used to identify feature dimensions that do not contribute to the classification results as invalid feature dimensions.

[0097] In one specific implementation, the classification unit is specifically used for:

[0098] The vectorized results of the validation document set are classified using the XGBOOST algorithm, random forest algorithm, or contribution evaluation algorithm to obtain the classification results.

[0099] In one specific implementation, the fusion module includes:

[0100] The deletion unit is used to delete feature data in invalid feature dimensions while retaining the dimension index of the invalid feature dimensions.

[0101] The mapping unit is used to map the feature data in the target feature dimension to the dimension index to obtain the fused feature model.

[0102] In one specific implementation, the mapping unit includes:

[0103] Establish sub-units to create a mapping table between feature data and dimension numbers in the target feature dimension;

[0104] The mapping subunit is used to fill the feature data in the target feature dimension with the dimension index based on the mapping table.

[0105] In one specific implementation, the third training module is specifically used for:

[0106] The hybrid PE file set is vectorized using a hybrid feature model; the vectorized result of the hybrid PE file set is used as the training set to train the file detection model.

[0107] In one specific implementation, it further includes:

[0108] Get the model, used to obtain the target file to be detected;

[0109] The vectorization module is used to vectorize the target file using a hybrid feature model;

[0110] The detection module is used to detect viruses by utilizing the vectorized processing results of the target file using a file detection model.

[0111] For more detailed information on the working process of each module and unit in this embodiment, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0112] As can be seen, this embodiment provides a model training device that can remove invalid features from the general feature model and add new features without changing the dimensions of the general feature model, thereby improving the model's detection capability.

[0113] The following describes an electronic device provided in an embodiment of this application. The electronic device described below can be referred to in conjunction with the model training method and apparatus described above.

[0114] See Figure 5 As shown in the figure, an embodiment of this application discloses an electronic device, including:

[0115] Memory 501 is used to store computer programs;

[0116] Processor 502 is configured to execute the computer program to implement the method disclosed in any of the above embodiments.

[0117] Please refer to Figure 6 , Figure 6 This is a schematic diagram of another electronic device provided in this embodiment. This electronic device can vary significantly due to differences in configuration or performance. It may include one or more central processing units (CPUs) 322 (e.g., one or more processors) and a memory 332, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 342 or data 344. The memory 332 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the data processing device. Furthermore, the central processing unit 322 may be configured to communicate with the storage media 330 and execute the series of instruction operations in the storage media 330 on the electronic device 301.

[0118] Electronic device 301 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341. Examples include Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0119] exist Figure 6 In this context, application 342 may be a program that executes a model training method, and data 344 may be data required or generated for executing the model training method.

[0120] The steps in the model training method described above can be implemented by the structure of an electronic device.

[0121] The following describes a readable storage medium provided in an embodiment of this application. The readable storage medium described below can be referred to in conjunction with the model training method, apparatus and device described above.

[0122] A readable storage medium is provided for storing a computer program, wherein the computer program, when executed by a processor, implements the model training method disclosed in the foregoing embodiments. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0123] The terms “first,” “second,” “third,” “fourth,” etc., used in this application (if applicable) are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, or apparatus that includes a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, or apparatus.

[0124] It should be noted that the use of terms such as "first" and "second" in this application is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed in this application.

[0125] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0126] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of readable storage medium known in the art.

[0127] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A model training method, characterized in that, include: A hybrid feature model was trained using a mixed set of PE files of various types as the training set. A target feature model is trained using a set of target PE files of a specific type as the training set. The invalid feature dimension corresponding to the hybrid feature model is determined, and the invalid feature dimension is replaced by the target feature dimension corresponding to the target feature model to obtain a fusion feature model covering general type PE files and a specific type PE file; A file detection model is trained based on the hybrid PE file set and the fusion feature model; Wherein, determining the invalid feature dimension corresponding to the hybrid feature model includes: The hybrid feature model is used to vectorize a set of verification files that combine multiple types. The vectorized processing results of the verification file set are classified using a classification algorithm to obtain the classification results; Feature dimensions that do not contribute to the classification results are identified as invalid feature dimensions.

2. The model training method according to claim 1, characterized in that, The classification algorithm is used to classify the vectorized processing results of the verification file set to obtain classification results, including: The vectorized processing results of the verification file set are classified using the XGBOOST algorithm, random forest algorithm, or contribution evaluation algorithm to obtain the classification results.

3. The model training method according to claim 1, characterized in that, The step of replacing the invalid feature dimension with the target feature dimension corresponding to the target feature model to obtain a fused feature model covering general-type PE files and a specific type of PE file includes: Delete the feature data in the invalid feature dimension, and retain the dimension index of the invalid feature dimension; The feature data in the target feature dimension is mapped to the dimension number to obtain the fused feature model.

4. The model training method according to claim 3, characterized in that, The step of mapping the feature data in the target feature dimension to the dimension index includes: Establish a mapping table between the feature data in the target feature dimension and the dimension index; Based on the mapping table, the feature data in the target feature dimension is filled into the dimension number.

5. The model training method according to claim 1, characterized in that, The file detection model trained based on the hybrid PE file set and the fusion feature model includes: The hybrid feature model is used to vectorize the hybrid PE file set; The file detection model is trained using the vectorized processing results of the hybrid PE file set as the training set.

6. The model training method according to any one of claims 1 to 5, characterized in that, Also includes: Obtain the target file to be detected; The target file is vectorized using the hybrid feature model. Virus detection is performed on the vectorized processing results of the target file using the file detection model.

7. A model training device, characterized in that, include: The first training module is used to train a hybrid feature model using a mixed set of PE files of multiple types as the training set. The second training module is used to train a target feature model using a set of target PE files of a specific type as the training set. The fusion module is used to determine the invalid feature dimension corresponding to the hybrid feature model, and replace the invalid feature dimension with the target feature dimension corresponding to the target feature model to obtain a fusion feature model that covers general type PE files and a specific type PE file. The third training module is used to train a file detection model based on the hybrid PE file set and the fusion feature model; The fusion module includes: The vectorization unit is used to perform vectorization processing on a set of verification files of multiple types using the hybrid feature model; A classification unit is used to classify the vectorized processing results of the verification file set using a classification algorithm to obtain a classification result; A determining unit is used to determine the feature dimensions that do not contribute to the classification result as the invalid feature dimensions.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the model training method as described in any one of claims 1 to 6.

9. A readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the model training method as described in any one of claims 1 to 6.

Images