A Malware Detection and Family Classification Method Based on Multi-Pruning Strategy and Deep Convolutional Generative Adversarial Networks

Abstract

This invention relates to a malware detection and family classification method based on a multi-cropping strategy and a deep convolutional generative adversarial network. The method involves: feeding a color image x of malware into a multi-cropping module to generate a local image x of malware. j The method of this invention includes the following steps: building a malware detection and family classification model based on a deep convolutional generative adversarial network; training the malware detection and family classification model; the malware detection and family classification model including a generator G, a scoring discriminator D1, and a classification discriminator D2; and using the stored classification discriminator D2 to detect and classify malware. This invention effectively solves the problems of insufficient samples and imbalanced samples in malware detection and family classification, improves the utilization rate of malware detection and family classification model parameters, improves the accuracy of malware variant detection and classification, and better ensures network security.

Description

Technical Field

[0001] This invention relates to a method for malware detection and family classification based on multi-pruning strategies and deep convolutional generative adversarial networks, belonging to the field of cybersecurity technology. Background Technology

[0002] Malware is a common type of cyberattack in the form of software; malware families include various types such as cryptominers, viruses, ransomware, worms, and spyware, all with the common goal of information or identity theft, espionage, and service disruption. In the years following the COVID-19 pandemic, Microsoft reported 16 different levels of malicious activity targeting businesses and academic institutions to steal research knowledge related to vaccines. AV-TEST data shows that over 1 billion infected files were reported in January 2021. As malware detection methods become increasingly sophisticated, malware developers widely use obfuscation, encryption, and other techniques to evade anti-malware detection, resulting in a diverse and polymorphic landscape of malware. Therefore, to prevent malware from infiltrating computer systems and causing damage, researchers need to develop more effective malware detection and classification methods.

[0003] In the field of malware detection and classification, machine learning methods are currently the primary approach. These methods visualize raw binary file samples as images, transforming the malware problem into an image classification problem and achieving good classification accuracy. However, these methods do not consider model overhead or appropriate strategies to address the issues of insufficient and imbalanced samples in malware detection and classification. Furthermore, traditional machine learning methods exhibit poor detection and classification accuracy for variant malware samples. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a malware detection and family classification method based on multi-pruning strategy and deep convolutional generative adversarial network, which effectively solves the problems of insufficient data and data imbalance in the malware detection and classification process, improves the accuracy of detecting and classifying new malware variants, and greatly reduces the hardware overhead in the model training process.

[0005] The present invention adopts the following technical solution:

[0006] This invention discloses a malware detection and family classification method based on multiple pruning strategies and deep convolutional generative adversarial networks, comprising the following steps:

[0007] Step 1. Input the color image x of the malware into the multi-cropping module to generate a partial image x of the malware. j The multi-clipping module is the multi-clipping strategy.

[0008] Step 2. Build a malware detection and family classification model based on deep convolutional generative adversarial networks;

[0009] Step 3. Train the malware detection and family classification model; the malware detection and family classification model includes a generator G, a scoring discriminator D1, and a classification discriminator D2;

[0010] Step 4: Use the saved classification discriminator D2 to detect and classify malware.

[0011] In step one of this invention, a multi-cropping module is used to generate a local image x of malware. j The steps are as follows:

[0012] S101. Set the brightness, contrast, saturation, and lightness values ​​of the malware color image x to half of their original values;

[0013] S102. Extract five 64×64 pixel partial images x from the top left, bottom left, top right, bottom right, and center of each malware color image x. j .

[0014] In step two of this invention, a generator G, a scoring discriminator D1, and a classification discriminator D2 are constructed based on a deep convolutional generative adversarial network. During training, the classification discriminator D2 uses the adversarial loss function of the scoring discriminator D1 and the generator G, and the cross-entropy loss function of the classification discriminator D2 on the input image to update its parameters. After the adversarial loss function converges, the average pooling layer of the classification discriminator D2 is fine-tuned.

[0015] The specific steps for training the classification discriminator D2 in step three of this invention are as follows:

[0016] 4.2.1) The original partial image of the malware x j And the fake image x generated by generator G fake And their true labels T(x) j ) and T(x fake This is passed as input to the classifier D2, and the loss function of the classifier D2 is calculated, as shown in the following formula:

[0017]

[0018] In formula (1): x fake For the fake image generated by generator G, T(x) fake T(x) represents the pseudo-label of the fake image generated by generator G. j ) indicates the actual label of a partial image of malware. This represents the parameters of the malware detection and family classification model for the classifier D2. This indicates that the classifier D2 is for x fake The predicted label results This indicates that the classifier D2 is for x j The predicted label result, Entropy(a, b), represents the cross-entropy loss function between a and b, i.e., the loss of the classifier D2 for a given sample's true label and predicted label, where β is the training weight. Let μ represent the adversarial loss function of the scoring discriminator D1 and the generator G. The weighting of losses;

[0019] 4.2.2) When the adversarial loss function of the scoring discriminator D1 and the generator G... Upon convergence, the last average pooling layer of the classifier D2 is fine-tuned, all layers preceding the average pooling layer are frozen, and the classifier D2 is updated using the following formula:

[0020]

[0021] In formula (2): This represents the parameters of the classifier D2 obtained after the i-th iteration. This represents the parameters of the classifier D2 obtained after the (i+1)th iteration. The learning rate of the classifier D2, For loss function Regarding parameters The gradient.

[0022] The specific steps for training the scoring discriminator D1 in step three of this invention are as follows:

[0023] 4.1.1) The malware partial image x j And the fake image x generated by generator G fake The sample is passed to the scoring discriminator D1, which uses D1 to determine whether the sample is real or fake. If the sample is a local image of malware, then... j If the sample is true, the label is 1; if the sample is a fake sample generated by generator G, the label is 0; the malware local image x is... j And the fake image x generated by generator G fake The loss function of the scoring discriminator D1 is passed as input to the scoring discriminator D1, and the formula for the loss function of the scoring discriminator D1 is:

[0024]

[0025] In formula (3): P data (x j ) is the original partial image of the malware. j Data distribution, Pdata (x fake ) is the fake image x generated by generator G. fake The data distribution is given by E, which is the mathematical expectation of the expression. This indicates that the scoring discriminator D1 is used for the original malware local image x. j The prediction results This indicates that the scoring discriminator D1 evaluates the fake image x generated by the generator G. fake The prediction results This represents the model parameters of the scoring discriminator D1;

[0026] 4.1.2) The operation of updating the scoring discriminator D1 is performed using the following formula:

[0027]

[0028] In formula (4): This represents the parameters of the scoring discriminator D1 obtained after the i-th iteration. This represents the parameters of the scoring discriminator D1 obtained after the (i+1)th iteration. The learning rate of the scoring discriminator D1, For loss function Regarding parameters The gradient.

[0029] The specific steps for training the training generator G in step three of this invention are as follows:

[0030] 4.3.1) The scoring discriminator D1 is used to evaluate the fake image x generated by the generator G. fake The prediction results are returned to the generator G, and the adversarial loss function of the generator G with respect to the scoring discriminator D1 is as follows:

[0031]

[0032] In formula (5): This indicates that discriminator D1 is effective for the generated fake image x. fake The prediction results This represents the parameters of the malware detection and family classification model for the scoring discriminator D1;

[0033] 4.3.2) The operation to update generator G uses the following formula:

[0034]

[0035] In formula (6): This represents the parameters of the generator G obtained after the i-th iteration. Let G represent the parameters of the generator G obtained after the (i+1)th iteration. Let G be the learning rate of the generator. For the loss function L with respect to the parameters The gradient.

[0036] The technical effects achieved by adopting the above solution are as follows:

[0037] 1. This invention combines multi-pruning strategies and deep convolutional generative adversarial networks for malware detection and family classification, providing a reliable tool for malware detection and family classification. This method effectively solves the problems of insufficient samples and imbalanced samples in malware detection and family classification while reducing feature engineering, and it improves the accuracy of malware variant detection and classification, thus better ensuring network security.

[0038] 2. This invention utilizes a multi-cropping module to obtain local images of malware, which can combine global and local multi-scale key information of malware, and also solve the problems of insufficient data and data imbalance.

[0039] 3. This invention constructs a generator G, a scoring discriminator D1, and a classification discriminator D2 based on a deep convolutional generative adversarial network. During training, the classification discriminator D2 uses the adversarial loss function of the scoring discriminator D1 and the generator G, and the cross-entropy loss function of the classification discriminator D2 on the input image to update its parameters. After the adversarial loss function converges, the average pooling layer of the classification discriminator D2 is fine-tuned. This improves the utilization rate of the parameters of the malware detection and family classification model, and improves the accuracy of malware detection and classification. Attached Figure Description

[0040] Appendix Figure 1 This is a flowchart of the present invention; Detailed Implementation

[0041] The present invention will now be described in further detail with reference to the accompanying drawings;

[0042] like Figure 1 As shown, this invention relates to a method for malware detection and family classification based on multi-pruning strategies and deep convolutional generative adversarial networks, comprising the following steps:

[0043] Step 1. Convert the malware into a color image. The specific steps are as follows:

[0044] 1.1) Download the Microsoft BIG2015 dataset, which contains .asm and .byte files of malware. This invention is mainly based on the .byte files in Microsoft BIG2015 for malware detection and classification.

[0045] 1.2) Remove special characters from .byte files, such as extra spaces and questions;

[0046] 1.3). Convert the BIG2015 .byte file into a byte array, put it into a memory buffer, and generate a color image x from the content buffer (using the cv2.imdecode tool);

[0047] 1.4) The generated BIG2015 color image dataset was divided into a training set and a validation set in a 7:3 ratio. The training set contained 7822 malware images, and the validation set contained 3046 malware images.

[0048] Step 2: Input the malware color image x generated in Step 1 into the multi-cropping module to generate a partial malware image x. j The specific steps are as follows:

[0049] 2.1) Set the brightness, contrast, saturation, and luminance values ​​of the color partial image of the malware to half of their original values;

[0050] 2.1) For each real malware color image x, extract a 64×64 pixel malware partial image from five positions: the top left corner, bottom left corner, top right corner, bottom right corner, and center. This results in each malware color image being transformed into five malware partial images x. j ;

[0051] Step 3. Build a malware detection and family classification model based on deep convolutional generative adversarial networks. The malware detection and family classification model includes a generator G, a scoring discriminator D1, and a classification discriminator D2.

[0052] 3.1) Construct generator G; the malware detection and family classification model structure of generator G is as follows:

[0053] 4x4ConvTranspose+BN+ReLU+4x4ConvTranspose+BN+ReLU+4x4ConvTranspose+BN+ReLU+4x4ConvTranspose+BN+ReLU+4x4ConvTranspose+Tanh;

[0054] 3.2). Construct a scoring discriminator D1; the malware detection and family classification model structure of the classification discriminator D1 is as follows:

[0055] 4x4Conv+LeakyRelu+4x4Conv+BN+LeakyRelu+4x4Conv+BN+LeakyRelu+4x4Conv+BN+LeakyRelu+4x4Conv+Sigmoid;

[0056] 3.3) Construct the classification discriminator D2; the malware detection and family classification model structure of the classification discriminator D2 is as follows:

[0057] 4x4Conv+LeakyRelu+4x4Conv+BN+LeakyRelu+4x4Conv+BN+LeakyRelu+4x4Conv+BN+LeakyRelu+4x4Conv+LeakyRelu+4x4AvgPool;

[0058] Step 4. Use the BIG2015 training set divided in Step 1 to train the generator G, the scoring discriminator D1, and the classification discriminator D2.

[0059] 4.1). The specific steps for training the scoring discriminator D1 are as follows:

[0060] 4.1.1) The malware partial image x j And the fake image x generated by generator G fake The sample is passed to the scoring discriminator D1, which uses D1 to determine whether the sample is real or fake. If the sample is a local image of malware, then... j If the sample is true, the label is 1; if the sample is a fake sample generated by generator G, the label is 0; the malware local image x is... j And the fake image x generated by C fake The loss function of the scoring discriminator D1 is passed as input to the scoring discriminator D1, and the formula for the loss function of the scoring discriminator D1 is:

[0061]

[0062] In formula (3): P data (x j (x) is a partial image of the original malware. j Data distribution, P data (x fake ) represents the fake image samples x generated by generator G. fake The data distribution is given by E, which is the mathematical expectation of the expression. This indicates that the scoring discriminator D1 is used for the original malware local image x. j The prediction results This indicates that the scoring discriminator D1 evaluates the fake image x generated by the generator G. fake The prediction results This represents the parameters of the malware detection and family classification model for the scoring discriminator D1;

[0063] 4.1.2) The operation of updating the scoring discriminator D1 uses the following formula:

[0064]

[0065] In formula (4): This represents the parameters of the scoring discriminator D1 obtained after the i-th iteration. This represents the parameters of the scoring discriminator D1 obtained after the (i+1)th iteration. The learning rate of the scoring discriminator D1, For loss function Regarding parameters The gradient.

[0066] 4.2). The specific steps for training the classifier D2 are as follows:

[0067] 4.2.1) The partial image of the original malware x j And the fake image x generated by generator G fake And their true labels T(x) j ) and T(x fake This is passed as input to the classifier D2, and the loss function of the classifier D2 is calculated, as shown in the following formula:

[0068]

[0069] In formula (1): x fake For the fake image generated by generator G, T(x) fake T(x) represents the pseudo-label of the fake image generated by generator G. j ) indicates the actual label of a partial image of malware. This represents the parameters of the malware detection and family classification model for the classifier D2. This indicates that the classifier D2 is for x fake The predicted label results This indicates that the classifier D2 is for x j The predicted label result, Entropy(a, b), represents the cross-entropy loss function between a and b, i.e., the loss of the classifier D2 for a given sample's true label and predicted label, where β is the training weight. Let μ represent the adversarial loss function of the scoring discriminator D1 and the generator G. The weighting of losses;

[0070] 4.2.2) When the adversarial loss function of the scoring discriminator D1 and the generator G... Upon convergence, the last average pooling layer of the classifier D2 is fine-tuned, all layers preceding the average pooling layer are frozen, and the classifier D2 is updated using the following formula:

[0071]

[0072] In formula (2): This represents the parameters of the classifier D2 obtained after the i-th iteration. This represents the parameters of the classifier D2 obtained after the (i+1)th iteration. The learning rate of the classifier D2, For loss function Regarding parameters The gradient.

[0073] 4.3 The specific steps for training the generator G are as follows:

[0074] 4.3.1) The scoring discriminator D1 is used to evaluate the fake image x generated by the generator G. fake The prediction results are returned to the generator G, and the adversarial loss function of the generator G with respect to the scoring discriminator D1 is as follows:

[0075]

[0076] In formula (5): This indicates that discriminator D1 is effective for the generated fake image x. fake The prediction results This represents the parameters of the malware detection and family classification model for the scoring discriminator D1;

[0077] 4.3.2) The operation to update generator G uses the following formula:

[0078]

[0079] In formula (6): This represents the parameters of the generator G obtained after the i-th iteration. Let G represent the parameters of the generator G obtained after the (i+1)th iteration. Let G be the learning rate of the generator. For the loss function L with respect to the parameters The gradient;

[0080] 4.4) The overall objective function during the training of the generator G, the scoring discriminator D1, and the classification discriminator D2 is:

[0081]

[0082] In formula (7): Let D1 be the loss function of the scoring discriminator. Let D2 be the classification loss function. Let G be the loss function for the generator G and the scoring discriminator D1.

[0083] Step 5: If the loss function has converged, stop training and proceed to Step 6; otherwise, repeat Step 4.

[0084] Step 6: Save the trained classifier D2;

[0085] Step 7: Input the BIG2015 validation set from Step 1 into the saved classifier D2 to verify the effectiveness of malware detection and classification.

[0086] This invention utilizes a multi-cropping module to obtain color local images of malware, and constructs a generator G, a scoring discriminator D1, and a classification discriminator D2 based on a deep convolutional generative adversarial network. This effectively solves the problems of insufficient and imbalanced data in malware detection and classification, and greatly reduces the hardware overhead during the training of malware detection and family classification models. Specifically, the classification discriminator D2 uses the adversarial loss function of the scoring discriminator D1 and the generator G, and the cross-entropy loss function of the classification discriminator D2 on the input image to update its parameters during training. After the adversarial loss function converges, the average pooling layer of the classification discriminator D2 is fine-tuned, improving the utilization rate of the malware detection and family classification model parameters and increasing the accuracy of malware variant detection and classification.

[0087] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions or improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for malware detection and family classification based on multi-pruning strategies and deep convolutional generative adversarial networks, characterized in that... The following steps are used: Step 1. Input the color image x of the malware into the multi-cropping module to generate a partial image x of the malware. j ; Generating partial images of malware using a multi-cropping module x j The steps are as follows: S101. Set the brightness, contrast, saturation, and lightness values ​​of the malware color image x to half of their original values; S102. Extract five 64×64 pixel partial images x from the top left, bottom left, top right, bottom right, and center of each malware color image x. j ; Step 2. Build a malware detection and family classification model based on deep convolutional generative adversarial networks; A generator G, a scoring discriminator D1, and a classification discriminator D2 are constructed based on a deep convolutional generative adversarial network. During training, the classification discriminator D2 uses the adversarial loss function of the scoring discriminator D1 and the generator G, and the cross-entropy loss function of the classification discriminator D2 on the input image to update its parameters. After the adversarial loss function converges, the average pooling layer of the classification discriminator D2 is fine-tuned. Step 3. Train the malware detection and family classification model; the malware detection and family classification model includes a generator G, a scoring discriminator D1, and a classification discriminator D2; The specific steps for training the classifier D2 are as follows: 4.2.1) The original partial image of the malware x j And the fake image x generated by generator G fake and label T(x) j ) and T(x fake This is passed as input to the classifier D2, and the loss function of the classifier D2 is calculated, as shown in the following formula: In formula (1): x fake For the fake image generated by generator G, T(x) fake T(x) represents the pseudo-label of the fake image generated by generator G. j ) indicates the actual label of a partial image of malware. This represents the parameters of the malware detection and family classification model for the classifier D2. This indicates that the classifier D2 is for x fake The predicted label results This indicates that the classifier D2 is for x j The predicted label result, Entropy(a,b), represents the cross-entropy loss function between a and b, i.e., the loss of the classifier D2 for a given sample's true label and predicted label, where β is the training weight. Let μ represent the adversarial loss function of the scoring discriminator D1 and the generator G. The weighting of losses; 4.2.2) When the adversarial loss function of the scoring discriminator D1 and the generator G... Upon convergence, the last average pooling layer of the classifier D2 is fine-tuned, all layers preceding the average pooling layer are frozen, and the classifier D2 is updated using the following formula: In formula (2): This represents the parameters of the classifier D2 obtained after the i-th iteration. This represents the parameters of the classifier D2 obtained after the (i+1)th iteration. The learning rate of the classifier D2, For loss function Regarding parameters The gradient; Step 4: Use the saved classification discriminator D2 to detect and classify malware.

2. The malware detection and family classification method based on multi-pruning strategies and deep convolutional generative adversarial networks according to claim 1, characterized in that... The specific steps for training the scoring discriminator D1 in step three are as follows: 4.1.1) The malware partial image x j And the fake image x generated by generator G fake The sample is passed to the scoring discriminator D1, which uses D1 to determine whether the sample is real or fake. If the sample is a local image of malware, then... j If the sample is true, the label is 1; if the sample is a fake sample generated by generator G, the label is 0; the malware local image x is... j And the fake image x generated by generator G fake The loss function of the scoring discriminator D1 is passed as input to the scoring discriminator D1, and the formula for the loss function of the scoring discriminator D1 is: In formula (3): P data (x j ) is the original partial image of the malware. j Data distribution, P data (x fake ) is the fake image x generated by generator G. fake The data distribution is given by E, which is the mathematical expectation of the expression. This indicates that the scoring discriminator D1 is used for the original malware local image x. j The prediction results This indicates that the scoring discriminator D1 evaluates the fake image x generated by the generator G. fake The prediction results This represents the parameters of the malware detection and family classification model for the scoring discriminator D1; 4.1.2) The operation of updating the scoring discriminator D1 is performed using the following formula: In formula (4): This represents the parameters of the scoring discriminator D1 obtained after the i-th iteration. This represents the parameters of the scoring discriminator D1 obtained after the (i+1)th iteration. The learning rate of the scoring discriminator D1, For loss function Regarding parameters The gradient.

3. The malware detection and family classification method based on multi-pruning strategy and deep convolutional generative adversarial networks according to claim 2, characterized in that... The specific steps for training the generator G in step three are as follows: 4.3.1) The scoring discriminator D1 is used to evaluate the fake image x generated by the generator G. fake The prediction results are returned to the generator G, and the adversarial loss function of the generator G with respect to the scoring discriminator D1 is as follows: In formula (5): This indicates that the scoring discriminator D1 evaluates the generated fake image x. fake The prediction results This represents the parameters of the malware detection and family classification model for the scoring discriminator D1; 4.3.2) The operation to update generator G uses the following formula: In formula (6): This represents the parameters of the generator G obtained after the i-th iteration. Let G represent the parameters of the generator G obtained after the (i+1)th iteration. Let G be the learning rate of the generator. For the loss function L with respect to the parameters The gradient.

Images