A malicious code visualization method based on information gain and co-occurrence matrix
By generating low-dimensional malware visualization images using information gain and co-occurrence matrices, the problems of feature redundancy and high time costs in existing technologies are solved, enabling efficient classification and detection of malware.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-01-05
- Publication Date
- 2026-04-07
AI Technical Summary
Existing methods for visualizing malicious code suffer from feature redundancy and high time costs, and the inconsistent size of grayscale images based on binary files affects classification efficiency.
A method based on information gain and co-occurrence matrix is adopted. By decompiling malicious code to generate assembly files, extracting opcode sequences, calculating information gain to filter features, generating co-occurrence matrix, and performing MaxAbs normalization and pixel mapping to form a low-dimensional visualization image for deep learning model training and detection.
It improves the efficiency and accuracy of malicious code classification, reduces feature redundancy, enhances the comparability of images and the distinguishability of family features, and improves the detection performance of deep learning models.
Smart Images
Figure CN115935360B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of malicious code analysis technology, and in particular to a malicious code visualization method based on information gain and co-occurrence matrix. Background Technology
[0002] Malware refers to any computer software that poses a potential threat to computers and networks. Currently, the number and variations of malicious code are increasing year by year, and the techniques for creating it are developing rapidly, posing a significant threat to global network security.
[0003] Although malware spawns numerous variants, the core elements within the same malware family share similarities and inheritance. These variants render signature-based detection methods ineffective, but visualizing malware as an image does not fundamentally alter the image's texture and structural features, effectively combating malware obfuscation. Compared to manually extracted feature vectors, malware images contain rich, almost complete, malware information. Whether through image structure, texture, and color analysis (local and global feature extraction) or by automatically learning image features using deep learning algorithms, malware visualization minimizes the impact of obfuscation techniques.
[0004] Malicious code visualization methods include visualizing as grayscale images and visualizing as color images. Currently, visualizing malicious code as grayscale images is the mainstream method for detecting malicious code. The following is a detailed introduction to common grayscale visualization methods.
[0005] Nataraj vectorization uses malicious binary files for encoding, then divides the original binary sequence into 8-bit subsequences. Because each malware family contains different attack types, resulting in variations in the size of the visualized images, a fixed image width is used to visualize the malware as a long, grayscale image. The approach of Nataraj vectorization is consistent with that of B2M (Browser-to-Manufacturer) and has been widely used in malware detection. Han et al. added entropy maps to Nataraj vectorization and used these maps to further determine similarity, thus improving and refining the process.
[0006] At the 2015 Black Hat conference, Davis et al. converted hexadecimal decompiled files into 4-bit binary and padded them to 64 bits, with each bit multiplied by 255 corresponding to a pixel grayscale value of 0 or 255. This method could transform malicious code into a grayscale image containing only pixels from 0 to 255, with each row of vectors corresponding to a line of machine code. Jiang Yongkang et al. also explored the selection of factors such as encoding length and encoding amount in depth and presented specific deep learning models.
[0007] Ni et al. proposed an MCSC method that combines opcode sequences and LSH to obtain opcode sequences in assembly instructions, and uses SimHash and bilinear interpolation to convert the opcode sequences into malicious code images. Because the images visualized by malicious code variants in this way have similar fingerprints in some areas, it is feasible to identify similar malicious code variants through image processing technology.
[0008] Qiao Yanchen et al. used compiler instruction word vectors to visualize malicious programs. The algorithm first obtains the compiler, treats instructions as words and functions as sentences, and converts the malicious code file into a document. Then, the Word2Vec algorithm is used to obtain assembly instruction word vectors from the document. The top 100 assembly instructions in the training set are counted, and each document is converted into a matrix. Finally, the matrix is normalized to obtain a visualized grayscale image.
[0009] Compared to grayscale images of malicious code, visualizing malicious code as color images preserves the main features of grayscale while emphasizing recurring data segments in the binary file, resulting in similar texture, color, and structural features in color images of similar malware families. For example, Wang Bo et al. segmented the binary sequence of malicious code into RGB three-channel values, thus visualizing the malicious code as a color image. Since not every bit in the malicious code is an integer multiple of 24 bits, bits less than 24 bits are padded with 1s. However, the drawback of this method is that the model is too complex, has a large number of parameters, and low training efficiency.
[0010] In summary, although existing static malware detection and classification methods have achieved certain successes, current malware visualization solutions still suffer from drawbacks such as feature redundancy and high time costs. Furthermore, the grayscale images based on binary files are affected by sample size, resulting in different visualization image sizes for different samples, which also brings inconvenience to subsequent classification. Summary of the Invention
[0011] This invention addresses the problems of feature redundancy and high time cost in existing malware visualization methods. The aim is to propose a malware visualization method based on information gain and co-occurrence matrix to improve the detection efficiency of the model.
[0012] To achieve the above objectives, the present invention provides the following technical solution:
[0013] This invention provides a method for visualizing malicious code based on information gain and co-occurrence matrix, comprising the following steps:
[0014] S1. Decompile the static malicious code binary file to obtain the assembly file, then extract the opcode sequence of each sample from the assembly file, and statistically obtain the opcode sequence set of all samples;
[0015] S2. Perform word frequency statistics on each sample according to the opcode sequence set of all samples, and then calculate the information gain of each opcode in combination with the category of the sample; sort the calculated information gains in descending order and select the first 32 opcode subsets as features; filter the opcode sequence of each sample extracted in step S1 according to the extracted opcode subsets. If the current opcode is in the subset, keep it, otherwise delete it to obtain the filtered opcode sequence.
[0016] S3. Set the sliding window length, slide the sliding window over the opcode sequence after each sample is filtered, count the sequence pairs of two adjacent opcodes, form a set of sequence pairs of each opcode, and then generate the co-occurrence matrix of each sample based on the sequence pair set; after all samples are processed, a co-occurrence matrix set is formed.
[0017] S4. Perform MaxAbs normalization and pixel mapping preprocessing on each matrix in the co-occurrence matrix set, and save the preprocessed co-occurrence matrix as a single-channel image with an image size of (32, 32).
[0018] S5. Use the obtained visualization images and their categories as the training dataset for the deep learning model, and then use the trained deep learning model to detect malicious code samples.
[0019] Furthermore, the specific process of step S1 is as follows:
[0020] S11. Use the decompilation tool IDA Pro to decompile the static malicious code binary file and generate an ASM compiled file;
[0021] S12. Use regular expressions to extract the opcode from each line of each ASM compiled file sample;
[0022] S13. Extract all opcodes of the sample and arrange them in order to form the opcode sequence s = {mov, pub, add, ...} for each sample;
[0023] S14. Extract the opcode sequences of all samples to form a sample opcode sequence set S = {s1, s2, ... s}. n}, where n is the number of samples.
[0024] Furthermore, the specific process of step S2 is as follows:
[0025] S21. Extract the opcode dictionary from all opcode sequences as features, then calculate the opcode word frequency in each sample opcode sequence, and use the opcode word frequency as the feature value.
[0026] S22. Calculate the information gain of each opcode term frequency in the opcode dictionary;
[0027] S23. Sort the processed results in descending order of information entropy, and select the first 32 opcodes as the feature dictionary M = {a1, a2, ..., a...} 32}, a i For opcodes;
[0028] S24. Traverse each sequence S of the opcode sequence set S. i If S ij If ∈M, then keep it; otherwise, delete it. ij This represents the j-th opcode of the i-th sample.
[0029] Furthermore, the calculation process for the information gain of the opcode in step S22 is as follows:
[0030] (1) Let the training set be D, where |D| represents the sample set size, i.e. the number of samples. Let there be K classes C. k ,k=1,2,…,K,|C k | Belongs to class C k The number of samples, Calculate the empirical entropy H(D) of dataset D:
[0031]
[0032] (2) Suppose that a certain opcode feature A has n distinct values {a1, a2, ..., a...} n Based on the values of A, divide D into n subsets D1, D2, ..., Dn. n ,|D i |For D i The number of samples, Subset D i Belongs to class C k The set of samples is D ik D ik =D i ∩C k ,|D ik |For sample D ik The number of elements, and the empirical conditional entropy H(D|A) of opcode feature A on dataset D:
[0033]
[0034] (3) Calculate information gain:
[0035] g(D,A)=H(D)-H(D|A)
[0036] The information gain of each opcode is calculated step by step using the method described above.
[0037] Furthermore, the specific process of step S3 is as follows:
[0038] S31. Set the sliding window to 2, traverse the opcode sequence samples, and assume the initial window state is [push, mov]. At this time, the center word is push, so push and mov co-occur. In the matrix, the position of push in the row and mov in the column is incremented by 1, and the position of mov in the row and push in the column is also incremented by 1.
[0039] S32. Move the window one word forward. Assuming the current state is still [add, mov], and the core word is add, increment the position with row add and column mov by 1, and also increment the position with row mov and column add by 1.
[0040] S33. Repeat the operation until the traversal is complete, and each sample forms a co-occurrence matrix C. i After all samples have been processed, a co-occurrence matrix set C is formed.
[0041] Furthermore, the MaxAbs standardization formula in step S4 is:
[0042]
[0043] The training data features are scaled to the range [0,1] by dividing by the maximum value of each feature.
[0044] Furthermore, the pixel mapping formula in step S4 is:
[0045] p (i,j) =X norm(i,j) ×255
[0046] Among them, X norm(i,j) X represents the result of MaxAbs normalization of each matrix in the co-occurrence matrix set C, such as X. norm(i,j) If X is 0, then the pixel value is 0. norm(i,j) If the value is 1, the pixel value is 255.
[0047] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0048] This invention proposes a malware visualization method based on information gain and co-occurrence matrices. First, it filters low-dimensional opcode features using information gain. Then, it generates visualization images for classification based on the co-occurrence matrix, converting opcode sequences into images. The co-occurrence matrix ensures comparability of similar content, meaning similar content will have similar opcode term co-occurrence frequencies. Information gain is used to extract opcodes that effectively distinguish different families, thus better representing malware family characteristics and increasing discriminative power. Simultaneously, opcode term frequency information is mined. Based on latent semantic information from co-occurrence, redundant term frequency information is removed, and term frequency features are filtered and fully utilized to further analyze the correlation between malware families, thereby improving classification effectiveness and detection efficiency. Attached Figure Description
[0049] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.
[0050] Figure 1 A flowchart of a malicious code visualization method based on information gain and co-occurrence matrix is provided for embodiments of the present invention.
[0051] Figure 2 This is a schematic diagram illustrating the generation of a visualization image based on a co-occurrence matrix, as provided in an embodiment of the present invention.
[0052] Figure 3 The training set accuracy provided by the transformer-VIT classification model in this embodiment of the invention.
[0053] Figure 4 The confusion matrix effect trained on the Microsoft dataset by the method provided in the embodiments of the present invention. Detailed Implementation
[0054] To better understand this technical solution, the method of the present invention will be described in detail below with reference to the accompanying drawings.
[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described examples are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention are within the scope of protection of the present invention.
[0056] The malicious code visualization method based on information gain and co-occurrence matrix proposed in this invention has the following overall process: Figure 1As shown, it includes the following steps:
[0057] S1. Malicious code sample decompilation to obtain assembly files: Decompile static malicious code binary files to obtain assembly files, then extract the opcode sequence of each sample from the assembly files, and statistically obtain the opcode sequence set of all samples.
[0058] The specific process of step S1 is as follows:
[0059] S11. Use the decompilation tool IDA Pro to decompile the static malicious code binary file and generate an ASM compiled file;
[0060] S12. Use regular expressions to extract the opcode from each line of each ASM compiled file sample;
[0061] S13. Extract all opcodes of the sample and arrange them in order to form the opcode sequence s = {mov, pub, add, ...} for each sample;
[0062] S14. Extract the opcode sequences of all samples to form a sample opcode sequence set S = {s1, s2, ... s}. n}, where n is the number of samples.
[0063] S2. Extract features based on the information gain of each opcode: Perform word frequency statistics on each sample according to the opcode sequence set of all samples, and then calculate the information gain of each opcode in combination with the category of the sample; sort the calculated information gains in descending order and select the first 32 opcode subsets as features; filter the opcode sequence of each sample extracted in step S1 according to the extracted opcode subsets. If the current opcode is in the subset, keep it; otherwise, delete it to obtain the filtered opcode sequence.
[0064] The specific process of step S2 is as follows:
[0065] S21. Extract the opcode dictionary {mov,pub,add,…} from all opcode sequences as features, and then calculate the opcode term frequency in each sample opcode sequence. Use the opcode term frequency as the feature value, such as {102,12,0,…,67}.
[0066] S22. Calculate the information gain of each opcode term frequency in the opcode dictionary;
[0067] The calculation process for information gain is as follows:
[0068] (1) Let the training set be D, where |D| represents the sample set size, i.e. the number of samples. Let there be K classes C. k ,k=1,2,…,K,|C k | Belongs to class Ck The number of samples, Calculate the empirical entropy H(D) of dataset D:
[0069]
[0070] (2) Suppose that a certain opcode feature A has n distinct values {a1, a2, ..., a...} n Based on the values of A, divide D into n subsets D1, D2, ..., Dn. n ,|D i |For D i The number of samples, Subset D i Belongs to class C k The set of samples is D ik D ik =D i ∩C k ,|D ik |For sample D ik The number of elements, and the empirical conditional entropy H(D|A) of opcode feature A on dataset D:
[0071]
[0072] (3) Calculate information gain:
[0073] g(D,A)=H(D)-H(D|A)
[0074] The information gain of each opcode is calculated step by step using the method described above.
[0075] S23. Sort the processed results in descending order of information entropy, and select the first 32 opcodes as the feature dictionary M = {a1, a2, ..., a...} 32}, a i For opcodes;
[0076] S24. Traverse each sequence S of the opcode sequence set S. i If S ij If ∈M, then keep it; otherwise, delete it. ij This represents the j-th opcode of the i-th sample.
[0077] S3. Generate co-occurrence matrix based on features: Set the sliding window length, slide the sliding window over the opcode sequence after each sample is filtered, count the sequence pairs of two adjacent opcodes, form a set of sequence pairs of each opcode, and then generate the co-occurrence matrix of each sample based on the sequence pair set; after all samples are processed, a co-occurrence matrix set is formed.
[0078] Construct a co-occurrence matrix for each sample based on the feature dictionary M, with a size of (32, 32). The horizontal and vertical columns correspond to each opcode in the feature dictionary M. For example, the value in the 3rd row and 5th column of the matrix represents the number of times the 3rd and 5th feature words appear simultaneously, and its value is also equal to the value in the 5th row and 3rd column of the matrix. The specific process of step S3 is as follows:
[0079] S31. Set the sliding window to 2, traverse the opcode sequence samples, and assume the initial window state is [push, mov]. At this time, the center word is push, so push and mov co-occur. In the matrix, the position of push in the row and mov in the column is incremented by 1, and the position of mov in the row and push in the column is also incremented by 1.
[0080] S32. Move the window one word forward. Assuming the current state is still [add, mov], and the core word is add, increment the position with row add and column mov by 1, and also increment the position with row mov and column add by 1.
[0081] S33. Repeat the operation until the traversal is complete, and each sample forms a co-occurrence matrix C. i After all samples have been processed, a co-occurrence matrix set C is formed.
[0082] S4. Co-occurrence matrix visualization: Perform MaxAbs normalization and pixel mapping preprocessing on each matrix in the co-occurrence matrix set, and save the preprocessed co-occurrence matrix as a single-channel image with an image size of (32, 32).
[0083] The MaxAbs standardization formula is:
[0084]
[0085] The training data features are scaled to the range [0,1] by dividing by the maximum value of each feature.
[0086] The pixel mapping formula is:
[0087] p (i,j) =X norm(i,j) ×255
[0088] Among them, X norm(i,j) This represents the result of MaxAbs normalization of each matrix in the co-occurrence matrix set C, multiplied by 255, and mapped to the [0, 255] pixel values of the image, as shown in X. norm(i,j) If X is 0, then the pixel value is 0. norm(i,j) If the value is 1, then the pixel value is 255. Then, the single-channel image corresponding to the co-occurrence matrix is used.
[0089] Constructing this model and normalizing word frequencies helps eliminate the influence of the frequency of feature terms, unifies quantification, reduces experimental errors, and facilitates processing and subsequent model construction.
[0090] S5. Deep learning models are used for classification and detection: The obtained visualization images and their categories are used as the training dataset for the deep learning model, and then the trained deep learning model is used to detect malicious code samples.
[0091] The dataset used for detection is provided by the Microsoft MalwareClassification Challenge (BIG 2015) Kaggle malware classification competition. The malware in this dataset was provided by Microsoft, and the training set contains a total of 10,896 malware entries. Each malware entry includes a binary file and a decompiled ASM file. The official documentation states that the provided malware data does not include the compilation environment, file information, or compiled PE header data; the malware data was generated using the IDA decompilation tool. This dataset comprises nine different malware families: Ramnit, Lollipop, Kelihos_ver3, Vundo, Simda, Tracur, Kelihos_ver1, Obfuscator.ACY, and Gatak. This invention divides the dataset into two parts: 80% is used as the training set, and the remaining 20% is used as the model validation set. The specific distribution is shown in Table 1.
[0092] Table 1
[0093]
[0094] Classification test results as follows Figure 2 As shown, there is a clear distinction between different families, which confirms the effectiveness of this feature extraction method. Furthermore, under the transformer-VIT classification model, the training set accuracy of this invention reached 99.8%, and the validation set accuracy was 97%. The training results on the training set are as follows... Figure 3 As shown, the model has achieved good classification results on the Microsoft 2015 dataset. The confusion matrix trained on the Microsoft dataset using the method of this invention is shown below. Figure 4 As shown, this model achieves 100% accuracy on the kelihos_ver3 and Gatak families, and 99% accuracy on the Ramnit, Lollipop, and Vundo families, demonstrating good classification performance.
[0095] In summary, this invention improves the accuracy of detection and classification on deep learning models by generating low-dimensional visualization images of malicious code.
[0096] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.
Claims
1. A method for visualizing malicious code based on information gain and co-occurrence matrix, characterized in that, Includes the following steps: S1. Decompile the static malicious code binary file to obtain the assembly file, then extract the opcode sequence of each sample from the assembly file, and statistically obtain the opcode sequence set of all samples; S2. Perform word frequency statistics on each sample according to the opcode sequence set of all samples, and then calculate the information gain of each opcode in combination with the category of the sample; sort the calculated information gains in descending order and select the first 32 opcode subsets as features; filter the opcode sequence of each sample extracted in step S1 according to the extracted opcode subsets. If the current opcode is in the subset, keep it, otherwise delete it to obtain the filtered opcode sequence. S3. Set the sliding window length, slide the sliding window over the opcode sequence after each sample is filtered, count the sequence pairs of two adjacent opcodes, form a set of sequence pairs of each opcode, and then generate the co-occurrence matrix of each sample based on the sequence pair set. After all sample processing is completed, a co-occurrence matrix set is formed. S4. Perform MaxAbs normalization and pixel mapping preprocessing on each matrix in the co-occurrence matrix set, and save the preprocessed co-occurrence matrix as a single-channel image with an image size of (32, 32). S5. Use the obtained visualization images and their categories as the training dataset for the deep learning model, and then use the trained deep learning model to detect malicious code samples.
2. The malicious code visualization method based on information gain and co-occurrence matrix according to claim 1, characterized in that, The specific process of step S1 is as follows: S11. Use the decompilation tool IDA Pro to decompile the static malicious code binary file and generate an ASM compiled file; S12. Use regular expressions to extract the opcode from each line of each ASM compiled file sample; S13. Extract all opcodes of the sample and arrange them in order to form the opcode sequence s = {mov, pub, add, ...} for each sample; S14. Extract the opcode sequences of all samples to form a sample opcode sequence set S = {s1, s2, ... s}. n }, where n is the number of samples.
3. The malicious code visualization method based on information gain and co-occurrence matrix according to claim 1, characterized in that, The specific process of step S2 is as follows: S21. Extract the opcode dictionary from all opcode sequences as features, then calculate the opcode word frequency in each sample opcode sequence, and use the opcode word frequency as the feature value. S22. Calculate the information gain of each opcode term frequency in the opcode dictionary; S23. Sort the processed results in descending order of information entropy, and select the first 32 opcodes as the feature dictionary M = {a1, a2, ..., a...} 32 }, a i For opcodes; S24. Traverse each sequence S of the opcode sequence set S. i If S ij If ∈M, then keep it; otherwise, delete it. ij This represents the j-th opcode of the i-th sample.
4. The malicious code visualization method based on information gain and co-occurrence matrix according to claim 3, characterized in that, The calculation process for the information gain of the opcode in step S22 is as follows: (1) Let the training set be D, where |D| represents the sample set size, i.e. the number of samples. Let there be K classes C. k ,k=1,2,…,K,|C k | Belongs to class C k The number of samples, Calculate the empirical entropy H(D) of dataset D: (2) Suppose that a certain opcode feature A has n distinct values {a1, a2, ..., a...} n Based on the values of A, divide D into n subsets D1, D2, ..., Dn. n ,|D i |For D i The number of samples, Subset D i Belongs to class C k The set of samples is D ik D ik =D i ∩C k ,|D ik |For sample D ik The number of elements, and the empirical conditional entropy H(D|A) of opcode feature A on dataset D: (3) Calculate information gain: g(D,A)=H(D)-H(D|A) The information gain of each opcode is calculated step by step using the method described above.
5. The malicious code visualization method based on information gain and co-occurrence matrix according to claim 1, characterized in that, The specific process of step S3 is as follows: S31. Set the sliding window to 2, traverse the opcode sequence samples, and assume the initial window state is [push, mov]. At this time, the center word is push, so push and mov co-occur. In the matrix, the position of push in the row and mov in the column is incremented by 1, and the position of mov in the row and push in the column is also incremented by 1. S32. Move the window one word forward. Assuming the current state is still [add, mov], and the core word is add, increment the position with row add and column mov by 1, and also increment the position with row mov and column add by 1. S33. Repeat the operation until the traversal is complete, and each sample forms a co-occurrence matrix C. i After all samples have been processed, a co-occurrence matrix set C is formed.
6. The malicious code visualization method based on information gain and co-occurrence matrix according to claim 1, characterized in that, The MaxAbs standardization formula for step S4 is: The training data features are scaled to the range [0,1] by dividing by the maximum value of each feature.
7. The malicious code visualization method based on information gain and co-occurrence matrix according to claim 1, characterized in that, The pixel mapping formula for step S4 is: p (i,j) =X norm(i,j) ×255 Among them, X norm(i,j) X represents the result of MaxAbs normalization of each matrix in the co-occurrence matrix set C, such as X. norm(i,j) If X is 0, then the pixel value is 0. norm(i,j) If the value is 1, the pixel value is 255.