A malware family classification model generation method and device

Abstract

The application provides a malware family classification model generation method and device, the method comprises the following steps: training a classification model by using feature vectors of each sample in an original malware family, and determining a representative sample in the original malware family; then constructing new training samples by using the representative sample and newly emerged malware samples, and updating the classification model by using the training samples to obtain a new malware family classification model. The application retains the classification knowledge of the original malware family by using the representative sample, and then absorbs the knowledge of new malware families, thereby reducing the sample quantity of the malware family, reducing the calculation cost, making the new malware family classification model not forget the classification knowledge of the original family, adapting to the increasing malware families, and improving the malware sample classification accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a malware family classification model generation method and device. BACKGROUND

[0002] Android is a Linux-based, open source and open source code operating system led and developed by Google and the Open Mobile Alliance in 2007, which has good open source and popularity and is widely used in mobile devices. Therefore, it has become the target of 97% of malware attacks. Studies have shown that Android malware has obvious family characteristics, and malware from the same family has very similar malicious behavior. Therefore, studying malware classification can help Android security analysts more efficiently analyze Android malware and thus avoid malicious behavior.

[0003] Most of the current most popular malware family classification methods are based on machine learning, which extracts features of Android malware in each family as a vector, and then uses SVM, RF and other classifiers for supervised learning. SUMMARY

[0004] The present application relates to the technical field of information security, and in particular to a malware family classification model generation method and device.

[0005] The present application discloses a malware family classification model generation method, comprising the following steps:

[0006] extracting feature vectors of each sample in the original malware family;

[0007] training a classification model using the extracted feature vectors of each sample;

[0008] determining representative samples in the original malware family using the extracted feature vectors of each sample;

[0009] constructing new training samples using the determined representative samples and newly emerged malware samples;

[0010] Update the classification model by using the training samples to obtain a new malware family classification model.

[0011] Further, the feature vector of each sample in the original malware family includes the following steps:

[0012] The APK file of each sample in the original malware family is decompiled, and the function call relationship is extracted to construct a function call graph (FCG);

[0013] The opcode sequence of each function is extracted as the node feature of the function;

[0014] The function call graph (FCG) and the node feature of each function are used to obtain a graph feature (O-SFCG) with node attributes;

[0015] The graph feature vector is transformed into a low-dimensional feature vector according to a preset rule.

[0016] Further, the feature vector of each sample in the original malware family includes the following steps:

[0017] The APK file of each sample in the original malware family is decompiled, and the function call relationship related to the preset sensitive API is extracted, and the sensitive function call graph is represented by an adjacency matrix A;

[0018] The code snippet of each function related to the preset sensitive API is extracted, and the opcode sequence is extracted as the node feature of the function, which is saved in the node feature vector X;

[0019] The sensitive function call graph and the node feature of each function are used to obtain a graph feature with node attributes, which is represented by the adjacency matrix A and the node feature vector X;

[0020] The graph feature with node attributes is input into a preset network model to transform the graph feature vector into a low-dimensional feature vector, and the preset network model is:

[0021]

[0022] The graph feature vector f graph , H ij ∈H out ,

[0023]

[0024]

[0025] wherein represents the degree matrix of W, W is a trainable weight, I is a unit matrix, and Rn is a n-dimensional real number.

[0026] Further, training a classification model using the extracted feature vectors of each sample specifically includes:

[0027] obtaining the real family label y of each sample * ;

[0028] obtaining the classification model F0by optimizing the parameters of f(x) to minimize E{l[y * , f(x)]};

[0029] wherein f(x) represents the output predicted by the model, l is a label smoothing loss function to represent the gap between the real sample and the output label, and E represents expectation.

[0030] Further, determining a representative sample in the original malware family using the extracted feature vectors of each sample specifically includes the following steps:

[0031] calculating the sum of distances between each sample of each original malware family and other samples of the same family, and taking the smallest sum of distances as the compactness of the sample of each original malware family;

[0032] calculating the sum of distances between each sample of each original malware family and other samples of the same family, and then performing difference operation with the compactness of the original malware family to obtain the deviation degree of each sample, and taking the sample with small deviation degree as the representative sample.

[0033] Further, updating the classification model using the training sample to obtain a new malware family classification model specifically includes:

[0034] updating the original classifier F0according to the following optimization of the loss function L to obtain the malware family classification model F N , wherein

[0035] L = (1 - p) L s + L h

[0036] L s is a minimization function to make the output of the original classifier close to the output of the new malware family classification model F N . h In order to ensure good classification effect of the new classification system, L N is a minimization function to make the difference between the output value of the new malware family classification model F

[0037] Further,

[0038]

[0039]

[0040] wherein x m represents the sample x m , is the probability of the original malicious family classifier F0 outputting the classification as the i-th family, is the probability of the i-th class output by the new classification system F N , wherein:

[0041]

[0042]

[0043] F0(x m ) is the probability output by the original classifier, N is the total number of classes, k is a parameter set to smooth the difference between the output probabilities, k is a positive integer, and c m is the true label of x m .

[0044] In a second aspect, correspondingly, the application also discloses a malware family classification model generation device, which comprises a feature vector extraction unit, a representative sample selection unit, a training sample generation unit and a model training unit, wherein:

[0045] The feature vector extraction unit is used to extract feature vectors of each sample in the original malware family.

[0046] The representative sample selection unit is used to determine representative samples in the original malware family by using the extracted feature vectors of each sample.

[0047] The training sample generation unit is used to construct new training samples by using the determined representative samples and newly emerged malware samples.

[0048] The model training unit is used to train an original classification model by using the extracted feature vectors of each sample in the original malware family, and is also used to update the original classification model by using the training samples output by the training sample generation unit to obtain a new malware family classification model.

[0049] Based on the above technical solution, the application has the following beneficial effects compared with the prior art:

[0050] The application discloses a malware family classification model generation method, a classification model is trained by using feature vectors of each sample in an original malware family, a representative sample in the original malware family is determined, new training samples are constructed by using the representative sample and newly emerged malware samples, and a new malware family classification model is obtained by updating the classification model by using the training samples. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 is a flow chart of a malware family classification model generation method in embodiment one;

[0052] Figure 2 is a flow chart of extracting feature vectors of each sample in an original malware family in embodiment one;

[0053] Figure 3 is a structural schematic diagram of a malware family classification model generation device in embodiment two. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical scheme and advantages of the application clearer, the application is further described in detail below by combining with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the application and do not limit the application.

[0055] Embodiment one

[0056] The application discloses a malware family classification model generation method, a classification model is trained by using feature vectors of each sample in an original malware family, a representative sample in the original malware family is determined, new training samples are constructed by using the representative sample and newly emerged malware samples, and a new malware family classification model is obtained by updating the classification model by using the training samples. Figure 1 as shown, the method comprises the following steps:

[0057] S01, extracting feature vectors of each sample in an original malware family.

[0058] Specifically, APK files (Android application package files) of each sample in the original malware family are decompiled, and function call relationships are extracted to construct a function call graph (FCG). In some embodiments, the feature vectors of each sample in the original malware family can be extracted by using some conventional technical methods in the prior art.

[0059] Preferably, specifically, the feature vectors of each sample in the original malware family are extracted by using a method as shown in Figure 2As shown, extracting the feature vector of each sample in the original malware family can include the following steps:

[0060] S101, the APK file of each sample in the original malware family is decompiled, the function call relationship is extracted, and a function call graph is constructed.

[0061] S102, the opcode sequence of each function is extracted as the node feature of the function.

[0062] The inventors found that the function call graph and the sensitive function call graph only represent the relationship between functions, without representing the role information of each function, and are easily affected by technical updates. Therefore, the application preferably extracts the opcode sequence of each function as the node feature of the function. Opcode is used to indicate the operation to be completed by the instruction, and the number of bits usually reflects the operation type of the machine. Experimental data shows that there are many opcode sequences, and only 255 commonly used ones are considered, such as data operation type and method call type, and the rest are classified as the 256th. That is, the opcode sequence generally includes fixed 256 codes, which is easy to extract and will not change with time and technology upgrade, and can increase the robustness of the sensitive function call graph to a certain extent.

[0063] S103, using the function call graph and the node feature of each function, a graph feature with node attributes is obtained.

[0064] For the function call graph (represented by adjacency matrix A), the code segment of each function can be extracted, and the opcode sequence can be extracted. Since there are 256 opcodes in total, a 256-dimensional vector X can be obtained, which is the node feature. According to the above operation, each function is assigned a node feature with rich semantic information. In this way, the newly constructed graph feature with node attributes not only maintains the same structure as the original function call graph to represent the calling relationship between functions, but also adds node features to represent the semantic information of the functions themselves, making it more robust in identifying malware.

[0065] S104, the graph feature vector is transformed into a low-dimensional feature vector according to a preset rule.

[0066] Preferably, the obtained adjacency matrix A and node feature matrix X can be input into a pre-set network (whose expression formula is shown as formula (1)), and the network includes at least two graph convolution layers, and the activation function is ReLU function (full name: Rectified Linear Unit, which is a commonly used activation function in artificial neural networks, and in general, it refers to the ramp function in mathematics):

[0067]

[0068] wherein denotes a degree matrix, H out is an output matrix, W is a trainable weight, and I is an identity matrix. The identity matrix is set in the embodiment of the application so that the node can calculate its own features when aggregating the features of neighboring nodes, thereby improving the accuracy of the calculation.

[0069] Since it is a graph classification task, the feature representation of the entire graph needs to be obtained, and therefore, a readout layer is often added after graph convolution to obtain the feature vector f graph of the entire graph (as represented by formula (2)), wherein H ij ∈H out , R n is an n-dimensional real number, and in the present example, is 512-dimensional:

[0070]

[0071] At this point, the feature vectors of the samples in the original malware family extracted can be guaranteed to be robust and will not change with time and technology upgrades, which is the basis for ensuring that the new malware family classification model can simultaneously classify the original family samples and new family samples under limited expenditure.

[0072] In other embodiments, preferably, in order to further characterize the behavior of the APK, only the call relationship related to the sensitive API is retained in step S101, thereby constructing a sensitive function call graph, and using an adjacency matrix A to represent the sensitive function call graph. Compared with the ordinary function call graph, the sensitive API-related function call graph has a smaller graph size to some extent, thereby improving the efficiency of feature processing. The subsequent steps are all based on this sensitive function call graph.

[0073] S02, training a classification model using the extracted feature vectors of the samples.

[0074] Specifically, training a classification model using the extracted feature vectors of the samples can include the following steps:

[0075] S201, obtaining the real family label y * of each sample.

[0076] S202, minimizing E{l[y * ,f(x)]} by optimizing the parameters of f(x) to obtain a classification model F0, which can be represented by formula (3):

[0077] F0=argmin f E{l[y *f(x) represents the output predicted by the model, l is a label smoothing loss function to represent the gap between the real sample and the output label, and E represents expectation.

[0078] f(x) represents the output predicted by the model, l is a label smoothing loss function to represent the gap between the real sample and the output label, and E represents expectation.

[0079] S03, determining a representative sample in the original malware family by using the extracted feature vector of each sample.

[0080] When a new sample comes, retraining the classifier with all original samples plus the new sample will linearly increase the computing overhead and memory. Therefore, the present application only selects a representative sample from each original family to fuse with the new family sample.

[0081] Specifically, determining a representative sample in the original malware family includes the following steps:

[0082] S301, calculating the sum of distances of each sample of each original malware family to other samples in the same family, and taking the smallest sum of distances as the compactness of each sample of the original malware family.

[0083] Specifically, for the feature vector X = {x1, x2, …, x N} of a sample in a family, the compactness of a sample in a certain original malware family is represented by the minimum distance (DM), and the calculation formula is shown in formula (4):

[0084]

[0085] In the formula, x i and x j represent different samples in the data set X, and N represents the number of samples. For a set X, a DM can be calculated.

[0086] S302, calculating the sum of distances of each sample of each original malware family to other samples in the same family, and then performing difference operation with the obtained compactness of the original malware family to obtain the deviation degree of each sample.

[0087] Specifically, for a sample x m , the importance d m of the sample is defined as shown in formula (5). The smaller the deviation degree of the sample, the stronger the representativeness of the sample.

[0088]

[0089] For convenience of calculation, the following normalization processing can be performed. First, the maximum value DMX of the sum of distances of each sample of the original malware family to other samples in the same family is obtained (as shown in formula 6), then the difference value between DMX and DM is obtained, and finally the importance d mDivide by the difference between DMX and DM (as shown in Formula 7):

[0090]

[0091]

[0092] Where, r m Indicates sample x m The contribution to probability density estimation can be defined as representativeness. m The smaller the value, the better the value of sample x. m The smaller the deviation from DM, the better x m The more representative the result, the better. The difference between DMX and DM can reflect the dispersion of data points in the entire dataset. X = {x1, x2, ..., x} can be calculated using the above method. N The representativeness of each sample in} is R = {r1, r2, ..., r} N}

[0093] S04, construct new training samples using established representative samples and newly emerging malware samples.

[0094] When new category samples emerge, the F0 classification model obtained in step S02 needs to be updated, so the training set needs to be updated first.

[0095] Assume there are m original families, n emerging new family categories, and T representative samples selected from the original families. Then, the number of samples selected from each family is t = T / m. At this point, the representativeness R = {r1, r2, ..., r...} calculated in S03 for each sample can be expressed as R = {r1, r2, ..., r...}. N Sort the samples from smallest to largest and select the top t most representative samples.

[0096] Finally, use |s m | represents the number of samples in each category, then the original sample training set T old ={s1,s2,…,s m},|s m |=t.

[0097] The updated training set is T new There are a total of m+n family samples, T new ={s1,s2,…,s m}∪{s m+1 ,s m+2 …,s m+n}

[0098] S05, update the classification model using the training samples to obtain a new malware family classification model.

[0099] The new training set T obtained by step S04 new Updating the original classifier F0 essentially needs to optimize the loss function L of the original malware family classification model. Since the classification knowledge of the original family samples is contained in the original classifier F0, preferably, the application can learn the classification knowledge of the original family by knowledge extraction, and then correct and learn the classification knowledge of the new family by the new training set, and finally optimize the loss function L.

[0100] Specifically, for sample x m , assuming that the probability of the i-th family output by the original malware family classifier F0 is as shown in formula (8):

[0101]

[0102] Where F0(x m ) is the probability output by the original classifier, N is the total number of categories, and k is a set parameter to smooth the difference between the output probabilities, and k is a positive integer.

[0103] And also for sample x m , assuming that the probability of the i-th class output by the new classification system F N is as shown in formula 9:

[0104]

[0105] Where F N (x m ) is the probability output by the newly constructed classifier, N is the total number of categories, and k is a set parameter, which is the same as k in formula (8).

[0106] In order to achieve the purpose of extracting the knowledge in F0 into F N , for sample x m and family i, the output of the original classifier and the output of the new classification system should be as close as possible, that is, the function L s (As shown in formula 10):

[0107]

[0108] On the other hand, in order to ensure the good classification effect of the new classification system, the difference between the predicted value and the real label should be as small as possible, that is, the function L h (As shown in formula (11)):

[0109]

[0110] Where c m is the real label of x m .

[0111] Finally, the loss function L of the model is L s and a weighted sum of L h , as shown in equation (12):

[0112] L = (1 - p)L s + L h (12)

[0113] In the process of training, L is optimized to ensure that the new model has classification ability for both new family samples and original family samples.

[0114] It can be understood that in some embodiments, steps S02 and S03 can be replaced, and the present application does not have special requirements for the order.

[0115] The application discloses a malware family classification model generation method, which trains a classification model by using feature vectors of each sample in an original malware family, determines a representative sample in the original malware family, constructs new training samples by using the representative sample and newly appeared malware samples, and updates the classification model by using the training samples to obtain a new malware family classification model. The application retains the classification knowledge of the original malware family by using the representative sample, and then absorbs the knowledge of new malware families, which reduces the sample quantity of the malware family and the calculation cost, and makes the new malware family classification model not forget the classification knowledge of the original family, can adapt to the increasing situation of the malware family, and has high malware sample classification accuracy.

[0116] In other embodiments, the inventors find that when training a new malware family classification model, if the quantity of new malware samples is small, the new model update is limited, and the accuracy of the new model is not high. Therefore, it is necessary to consider increasing the quantity of new samples. Since the basis for dividing the malware family is whether the malicious behaviors are the same, it can be considered to repack each sample file in the newly appeared malware family, insert garbage code fragments, disturb the code sequence, or encrypt identifiers, so as to increase the quantity of each family sample.

[0117] Specifically, for example, the smail file of the new malware sample apk can be modified, and then the apktool needs to be used to recompile the apk file to complete the repacking of the sample. In addition, inserting garbage code fragments, disturbing the code sequence, or identifier encryption will not change the malicious behaviors in the malware sample, and therefore can be used to increase the quantity of the malware family sample, so as to ensure better training of the new malware family classification model.

[0118] Embodiment two

[0119] The application further discloses a malware family classification model generation device, which is combinedFigure 3 As shown, the system comprises a feature vector extraction unit 10, a representative sample selection unit 20, a training sample generation unit 30, and a model training unit 40, wherein:

[0120] The feature vector extraction unit 10 is configured to extract feature vectors of each sample in the original malware family.

[0121] Specifically, the feature vector extraction unit 10 is configured to decompile the APK file of each sample in the original malware family, extract the function call relationship, and construct a function call graph. Then, the opcode sequence of each function is extracted as the node feature of the function. Then, the graph feature with node attributes is obtained by using the function call graph and the node features of each function. Finally, the graph feature vector is transformed into a low-dimensional feature vector according to a preset rule.

[0122] Preferably, the feature vector extraction unit 10 can also decompile the APK file of each sample in the original malware family, extract the function call relationship related to the preset sensitive API, and generate a sensitive function call graph. Then, the code snippet of each function related to the preset sensitive API is extracted, and the opcode sequence is extracted as the node feature of the function. Then, the graph feature with node attributes is obtained by using the sensitive function call graph and the node features of each function. Finally, the graph feature with node attributes is input into a preset network model, and the graph feature is transformed into a low-dimensional feature vector.

[0123] The representative sample selection unit 20 is configured to determine the representative sample in the original malware family by using the extracted feature vectors of each sample.

[0124] Specifically, the representative sample selection unit 20 is configured to calculate the sum of distances between each sample of each original malware family and other samples of the same family, and take the smallest sum of distances as the compactness of each sample of the original malware family. The representative sample selection unit 20 is also configured to calculate the sum of distances between each sample of each original malware family and other samples of the same family, and then perform difference operation with the compactness of the original malware family to obtain the deviation degree of each sample. The sample with small deviation degree is taken as the representative sample.

[0125] The training sample generation unit 30 is configured to construct new training samples by using the determined representative samples and newly emerged malware samples.

[0126] Specifically, assuming that there are m original families and n newly emerged families, and the total number of selected representative samples is T. Then, the number of samples selected from each family is t=T / m. At this time, the representativeness R={r1, r2, …, rm} of each sample calculated in the representative sample selection unit is obtained. Then, the representative sample selection unit is configured to calculate the distance between each sample and the representative sample of the same family, and then calculate the distance between each sample and the representative sample of other families. Then, the distance between each sample and the representative sample of the same family is subtracted from the distance between each sample and the representative sample of other families to obtain the distance between each sample and the representative sample of the original family. Then, the distance between each sample and the representative sample of the original family is taken as the deviation degree of each sample. The sample with small deviation degree is taken as the representative sample. NSort them from small to large, and select the top t more representative samples.

[0127] Finally, use |s m to represent the number of samples in each category, then the original sample training set T old = {s1, s2, …, s m}, |s m | = t.

[0128] The updated training set is T new , which has a total of m+n samples from the family, T new = {s1, s2, …, s m}∪{s m+1 , s m+2 …, s m+n}.

[0129] In some embodiments, if the number of new malware samples is small, it will result in limited updates to the new model, and the accuracy of the new model will not be high. Therefore, the training sample generation unit is also used to repack each sample file in the newly emerging malware family, insert garbage code fragments, disturb the code order, or encrypt the identifier, so as to increase the number of samples in each family.

[0130] The model training unit 40 is configured to train an original classification model using the extracted feature vectors of the samples in the original malware family, and is also configured to update the original classification model using the training samples output by the training sample generation unit to obtain a new malware family classification model.

[0131] Specifically, the original classification model F0 satisfies the above formula (3), that is, by optimizing the parameters of f(x) to minimize E{l[y * , f(x)]} to obtain the classification model F0:

[0132] F0 = argmin f E{l[y * , f(x)]} (3)

[0133] f(x) represents the output of the model prediction, l is a label smoothing loss function to represent the gap between the true sample and the output label, and E represents the expectation.

[0134] Updating the original classification model using the training samples output by the training sample generation unit to obtain a new malware family classification model is essentially updating the loss function L of the classification model, as shown in the above formula (12):

[0135] L = (1-ρ)L s + L h (12)

[0136] Ls L is a minimization function for making the output of the original classifier close to the output of the new malware family classification model. h In order to ensure good classification effect of the new classification system, a minimization function is used to make the difference between the output value of the new malware family classification model and the real label small.

[0137] The specific working process of the malware family classification model generation device of the embodiment can refer to Embodiment One, which will not be described here.

[0138] Embodiment Three

[0139] In other embodiments, the application also provides a malware family classification model, and the loss function is shown in formula (12) as follows:

[0140] L = (1 - p) L s + L h (12)

[0141] L s is a minimization function for making the output of the original classifier close to the output of the new malware family classification model. h In order to ensure good classification effect of the new classification system, a minimization function is used to make the difference between the output value of the new malware family classification model and the real label small.

[0142]

[0143]

[0144] Wherein, x m represents a sample x m , is the probability of the output of the original malware family classifier being classified as the i-th family, is the probability of the i-th class output by the new classification system F N , wherein:

[0145]

[0146]

[0147] F0(x m ) is the probability output by the original classifier, F N (x m ) is the probability output by the new classifier, N is the total number of classes, k is a set parameter to smooth the difference between the output probabilities, k is a positive integer, and c m is the real label of x m .

[0148] In practical applications, the loss function of the new malware family classification model can be quickly obtained by using the above formula, so as to improve the generation efficiency of the malware family classification model.

[0149] In the detailed description above, various features are grouped together in single embodiments for the purpose of streamlining the disclosure. This disclosure is not to be interpreted in determining the requirements of the claimed subject matter. Rather, the claims are to be interpreted as encompassing all novel features and a combination of features that are potentially present in every aspect of the disclosed subject matter. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description as examples of the claimed subject matter.

[0150] The above description includes examples of one or more embodiments. Of course, not all possible combinations of components or methods described above will be described as embodiments. One of ordinary skill in the art will recognize that further combinations and permutations of the embodiments described herein are possible. Thus, the foregoing description is intended to embrace all such alterations, modifications and variations in the process and / or components disclosed herein. Further, any terms of description or claims that use the expression "comprising" are to be interpreted as meaning "including but not limited to" or "including at least". Furthermore, any term of description or claim that uses the expression "or" is to be interpreted as meaning "and / or".

Claims

1. A method for generating a malware family classification model, the method comprising: The method comprises the following steps: extracting feature vectors of each sample in the original malware family; training a classification model using the extracted feature vectors of each sample; determining a representative sample in the original malware family using the extracted feature vectors of each sample; constructing new training samples using the determined representative sample and a newly emerged malware sample; updating the classification model to obtain a new malware family classification model, specifically comprising: updating the original classifier according to the following optimization of the loss function L to obtain the new malware family classification model, wherein, a minimization function that minimizes the difference between the output of the original classifier and the output of the new malware family classification model, a minimization function that minimizes the difference between the output of the new malware family classification model and the true label, wherein: wherein, representative samples , is the probability that the original malicious family classifier outputs a classification of the th family, is the probability that the new classification system outputs a classification of the th class, wherein: is the probability of the original classifier output, is the probability of the new classifier output, is the total number of classes, is a parameter set to smooth the difference between the output probabilities, takes a positive integer, is the true label of the input.

2. The malware family classification model generation method of claim 1, wherein, extracting feature vectors of each sample in the original malware family comprises the following steps: decompiling the APK file of each sample in the original malware family to extract function call relationships and construct a function call graph; extracting the opcode sequence of each function as the node feature of the function; obtaining a graph feature with node attributes using the function call graph and the node feature of each function; transforming the graph feature into a low-dimensional feature vector according to a preset rule.

3. The malware family classification model generation method of claim 1, wherein, extracting feature vectors of each sample in the original malware family comprises the following steps: decompiling the APK file of each sample in the original malware family to extract the function call relationships related to the preset sensitive API and generate a sensitive function call graph; extracting the code snippet of each function related to the preset sensitive API and extracting the opcode sequence as the node feature of the function; obtaining a graph feature with node attributes using the sensitive function call graph and the node feature of each function; inputting the graph feature with node attributes into a preset network model to transform the graph feature into a low-dimensional feature vector.

4. The malware family classification model generation method of claim 3, wherein, The preset network model is: wherein, is a graph feature vector, A is an adjacency matrix representing the call graph of the sensitive function, X is a node feature vector of each function, ReLU is an activation function, denotes a degree matrix of, W is a trainable weight, I is an identity matrix, is an n-dimensional real number.

5. The malware family classification model generation method of claim 1, wherein, training a classification model using the extracted feature vectors of each sample specifically comprises: obtaining true family labels for each sample ; by optimizing parameters of such that minimizing results in a classification model ; wherein, represents the output predicted by the model, is a label smoothing loss function to represent the gap between the real sample and the output label, and E represents expectation.

6. The malware family classification model generation method of claim 1, wherein, determining a representative sample in the original malware family using the extracted feature vectors of each sample specifically comprises the following steps: calculating the sum of distances of each sample of each original malware family to other samples of the same family, and taking the smallest distance sum as the compactness of each sample of the original malware family; calculating the sum of distances of each sample of each original malware family to other samples of the same family, and then performing difference operation with the compactness of the original malware family to obtain the deviation degree of each sample, and taking the sample with small deviation degree as the representative sample.

7. The malware family classification model generation method of claim 2, wherein, Constructing new training samples using the determined representative sample and a newly emerged malware sample further comprises: repacking each sample file in the newly emerged malware family, inserting garbage code snippets, disturbing code order, or identifier encryption.

8. A malware family classification model generation apparatus characterized by comprising: The method comprises a feature vector extraction unit, a representative sample selection unit, a training sample generation unit, and a model training unit, wherein: the feature vector extraction unit is configured to extract feature vectors of each sample in the original malware family; the representative sample selection unit is configured to determine a representative sample in the original malware family using the extracted feature vectors of each sample; the training sample generation unit is configured to construct new training samples using the determined representative sample and a newly emerged malware sample; and the model training unit is configured to update the classification model to obtain a new malware family classification model. The model training unit is configured to train an original classification model by using the feature vectors of the samples of the original malware family, and update the original classification model by using the training samples output by the training sample generation unit to obtain a new malware family classification model, and specifically includes: The original classifier is updated according to the following optimization loss function L to obtain a new malware family classification model, wherein, The original classifier is updated according to the following optimization loss function L to obtain a new malware family classification model, wherein, a minimization function that minimizes the difference between the output of the original classifier and the output of the new malware family classification model, a minimization function that minimizes the difference between the output of the new malware family classification model and the true label, wherein: wherein, representative samples , is the probability that the original malicious family classifier outputs a classification of the th family, is the probability that the new classification system outputs a classification of the th class, wherein: is the probability of the original classifier output, is the probability of the new classifier output, is the total number of classes, is a parameter set to smooth the difference between the output probabilities, takes a positive integer, is the true label of .

Images