A malware detector training method and device, computer equipment and storage medium

Abstract

The application provides a malware detector training method and device, computer equipment and a storage medium. The method comprises: obtaining a training data set comprising a plurality of first feature vectors corresponding to malicious application programs and a plurality of second feature vectors corresponding to benign application programs; iteratively training a backbone network of a neural network model using the training data set to obtain a neural network model that has completed primary training; constructing the neural network model into a second neural network model to be trained comprising N-2 auxiliary networks, and iteratively training the auxiliary networks of the second neural network model using the training data set to obtain a neural network model that has completed secondary training; and iteratively training the neural network model that has completed secondary training using adversarial training data to obtain a malware detector. The training method provided by the application considers the potential adversarial weaknesses of the intermediate layers of the backbone network when performing adversarial training, and has better defense capabilities.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of artificial intelligence, in particular to a training method of a malware detector, a device thereof, a computer device and a storage medium. BACKGROUND

[0002] The related technology uses deep learning technology to deal with malware variants, however, the malware detector based on deep learning is vulnerable to adversarial malware, and the attacker modifies the malware through adversarial attack technology, so that the modified adversarial malware can evade the detection of the detector.

[0003] Adversarial training is one of the most effective defense means for the malware detector based on deep learning to resist adversarial malware. The adversarial attack technology used in the existing adversarial training method only considers searching for adversarial vulnerabilities from the perspective of the whole model, and needs to be further improved to improve the defense effect of adversarial training. SUMMARY

[0004] The purpose of the present application is to provide a training method that considers the adversarial vulnerabilities of the intermediate layers of the backbone network during the training process, to solve the problem of lack of effective use of the intermediate layers of the network in the traditional adversarial training process, and has the advantage of good defense effect.

[0005] In order to achieve the above purpose, the present application provides a training method of a malware detector, which comprises the following steps:

[0006] Obtain a training data set, which includes a plurality of first feature vectors corresponding to a plurality of malicious application programs, and a plurality of second feature vectors corresponding to a plurality of benign application programs;

[0007] Obtain a first neural network model to be trained, and perform primary iterative training on the backbone network of the first neural network model to be trained using the training data set, to obtain a neural network model that has completed primary training, wherein the total number of layers of the backbone network is N layers, and N is a positive integer greater than 2;

[0008] Construct the neural network model that has completed primary training into a second neural network model to be trained including N-2 auxiliary networks, and perform secondary iterative training on the auxiliary networks of the second neural network model to be trained using the training data set to obtain a neural network model that has completed secondary training; wherein the first layer to the N-2 layer of the backbone network are respectively provided with one auxiliary network, and the output ends of the first layer to the N-2 layer of the backbone network are respectively connected with the input ends of the N-2 auxiliary networks;

[0009] The neural network model completed with the secondary training is iteratively trained with adversarial training data to obtain the malware detector, the adversarial training data is composed of a preset number of target first feature vectors and a preset number of target second feature vectors in the training data set, and an adversarial feature vector corresponding to each target first feature vector, the target first feature vector is any one first feature vector in the training data set, and the target second feature vector is any one second feature vector in the training data set, wherein

[0010] Any one iteration update of the third iterative training comprises: obtaining a preset number of target first feature vectors and a preset number of target second feature vectors, obtaining an adversarial feature vector of each target first feature vector according to the neural network model updated in the last iteration, updating the backbone network parameters of the neural network model updated in the last iteration according to all the target first feature vectors, target second feature vectors and adversarial feature vectors obtained to obtain the neural network model updated in the current iteration, and if the first iteration end condition is not met, the neural network model updated in the current iteration is updated in the next iteration.

[0011] In a specific embodiment, the step of obtaining the training data set comprises:

[0012] Obtaining an application set, the application set comprising a plurality of malicious applications and a plurality of benign applications;

[0013] Extracting API call information of each application in the application set, and collecting API call information of all applications to obtain an API call information set;

[0014] Based on the API call information set of the application set and the API call information of each application, obtaining a feature vector of each application, wherein the feature vector corresponding to the malicious application is a first feature vector, and the feature vector corresponding to the benign application is a second feature vector;

[0015] Collecting feature vectors of all applications as a training data set, the training data set comprising a plurality of first feature vectors corresponding to the plurality of malicious applications and a plurality of second feature vectors corresponding to the plurality of benign applications.

[0016] In a specific embodiment, the step of obtaining a feature vector of each application based on the API call information set of the application set and the API call information of each application comprises:

[0017] Counting the number of occurrences of each API call information in the API call information set;

[0018] obtain an API feature dictionary, the API feature dictionary including top M API call information in the API call information set, M being a positive integer greater than 300;

[0019] extract API call information of each application program, and convert each application program into a feature vector for representing the application program based on a comparison result of API call information of each application program and the API feature dictionary, wherein the feature vector corresponding to each malicious application program is a first feature vector, and the feature vector corresponding to each benign application program is a second feature vector.

[0020] In a specific embodiment, the step of obtaining, according to the neural network model updated in the last iteration, the adversarial feature vector of each target first feature vector includes:

[0021] According to the neural network model updated in the last iteration, the obtained each target first feature vector is iteratively updated for a preset number of times to obtain the adversarial feature vector of each target first feature vector, wherein any one of the preset number of iterative updates includes:

[0022] calculating a total perturbation according to the input feature vector updated in the last iteration;

[0023] calculating perturbations of a plurality of intermediate layers of the backbone network based on a sum of the input feature vector updated in the last iteration and the total perturbation, the plurality of intermediate layers of the backbone network being the 1st layer to the N-2th layer of the backbone network corresponding to the N-2 auxiliary networks; and obtaining a best perturbation corresponding to the updated input feature vector based on the perturbations of the plurality of intermediate layers of the backbone network and the total perturbation;

[0024] the sum of the input feature vector updated in the last iteration and the best perturbation is taken as the adversarial feature vector updated in the current iteration;

[0025] If the second iteration end condition is not met, the adversarial feature vector updated in the current iteration is normalized to obtain an input feature vector updated in the current iteration, and is input into the neural network model updated in the last iteration for next iteration update.

[0026] The application also provides a training device of a malware detector, the device comprising:

[0027] an obtaining module configured to obtain a training data set, the training data set including a plurality of first feature vectors corresponding to a plurality of malicious application programs and a plurality of second feature vectors corresponding to a plurality of benign application programs;

[0028] a first training module configured to obtain a first neural network model to be trained, and perform first-level iterative training on a backbone network of the first neural network model to be trained by using the training data set to obtain a neural network model after primary training, wherein the backbone network has a total of N layers, and N is a positive integer greater than 2;

[0029] a second training module configured to construct the neural network model after primary training into a second neural network model to be trained including N-2 auxiliary networks, and perform second-level iterative training on the auxiliary networks of the second neural network model to be trained by using the training data set to obtain a neural network model after secondary training, wherein the first layer to the (N-2)th layer of the backbone network are respectively provided with one auxiliary network, and output ends of the first layer to the (N-2)th layer of the backbone network are respectively connected to input ends of the N-2 auxiliary networks;

[0030] a third training module configured to perform third-level iterative training on the neural network model after secondary training by using adversarial training data to obtain the malware detector, wherein the adversarial training data is composed of a preset number of target first feature vectors and a preset number of target second feature vectors in the training data set, and an adversarial feature vector corresponding to each target first feature vector, the target first feature vector is any one first feature vector in the training data set, the target second feature vector is any one second feature vector in the training data set,

[0031] wherein any one iteration update of the third-level iterative training includes: reacquiring a preset number of target first feature vectors and a preset number of target second feature vectors, acquiring an adversarial feature vector of each target first feature vector according to the neural network model after the last iteration update, updating the backbone network parameters of the neural network model after the last iteration update according to all the target first feature vectors, target second feature vectors and adversarial feature vectors acquired to obtain a neural network model after current iteration update, and if a first iteration end condition is not met, performing next iteration update on the neural network model after the current iteration update.

[0032] In a specific embodiment, the obtaining module is specifically configured to:

[0033] obtain an application set, wherein the application set includes a plurality of malicious applications and a plurality of benign applications;

[0034] extract API call information of each application in the application set, and collect API call information of all the applications to obtain an API call information set;

[0035] obtaining a feature vector of each application program based on the API call information set of the application program set and the API call information of each application program, wherein the feature vector corresponding to the malicious application program is a first feature vector, and the feature vector corresponding to the benign application program is a second feature vector;

[0036] taking the set of the feature vectors of all the application programs as a training data set, and the training data set includes a plurality of first feature vectors corresponding to the plurality of malicious application programs and a plurality of second feature vectors corresponding to the plurality of benign application programs.

[0037] In a specific embodiment, the obtaining module is specifically configured to:

[0038] counting the number of occurrences of each API call information in the API call information set;

[0039] obtaining an API feature dictionary, and the API feature dictionary includes the first M API call information with the largest number of occurrences in the API call information set, and M is a positive integer greater than 300;

[0040] extracting the API call information of each application program, and converting each application program into a feature vector for representing the application program based on the comparison result of the API call information of each application program and the API feature dictionary, wherein the feature vector corresponding to each malicious application program is a first feature vector, and the feature vector corresponding to each benign application program is a second feature vector.

[0041] In a specific embodiment, the third training module is further configured to:

[0042] According to the neural network model updated according to the last iteration, each target first feature vector obtained is iteratively updated for a preset number of times to obtain the adversarial feature vector of each target first feature vector, wherein any one of the preset number of iterative updates comprises: calculating an overall disturbance according to the input feature vector updated according to the last iteration; calculating the disturbance of the plurality of intermediate layers of the backbone network based on the sum of the input feature vector updated according to the last iteration and the overall disturbance, the plurality of intermediate layers of the backbone network being the 1st layer to the N-2th layer of the backbone network corresponding to the N-2 auxiliary networks; based on the disturbance of the plurality of intermediate layers of the backbone network and the overall disturbance, obtaining the optimal disturbance corresponding to the updated input feature vector; the sum of the input feature vector updated according to the last iteration and the optimal disturbance is the adversarial feature vector updated according to the current iteration; if the second iteration end condition is not met, the adversarial feature vector updated according to the current iteration is normalized to obtain the input feature vector updated according to the current iteration, and is input to the neural network model updated according to the last iteration for the next iteration update.

[0043] The application further provides a computer device, characterized in that the computer device comprises a processor and a memory, the memory storing a computer program, and the processor implements the method according to any one of the preceding embodiments when executing the computer program.

[0044] The application further provides a computer readable storage medium, wherein when instructions in the computer readable storage medium are executed by a processor, the processor executes the method according to any one of the preceding embodiments.

[0045] The application has at least the following beneficial effects:

[0046] The application takes a plurality of first feature vectors corresponding to a plurality of malicious application programs and a plurality of second feature vectors corresponding to a plurality of benign application programs as a training data set, first uses the training data set to perform one-level iterative training on a backbone network of a neural network model, then uses the training data set to perform two-level iterative training on an auxiliary network of the neural network model that has completed one-level iterative training, obtains a plurality of target first feature vectors and a plurality of target second feature vectors in a random selection manner, then uses the gradients of the backbone network and the auxiliary network to generate an adversarial feature vector of the target first feature vector, and finally uses the plurality of target first feature vectors and the plurality of target second feature vectors and the adversarial feature vector of the target first feature vector as adversarial training data to perform three-level iterative training on the backbone network of the neural network model that has completed two-level iterative training; in this way, when the neural network model is iteratively trained at multiple levels, the potential adversarial weakness of the intermediate layer of the backbone network is considered, the intermediate layer of the backbone network can obtain better anti-interference capability through three-level iterative training, and the overall defense capability of the neural network is improved. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 A method flowchart of a training method of a malware detector provided for an embodiment of the application is provided.

[0048] Figure 2 A method flowchart of step S10 provided for an embodiment of the application is provided.

[0049] Figure 3 A method flowchart of step S13 provided for an embodiment of the application is provided.

[0050] Figure 4 A structure diagram of a backbone network and an auxiliary network in a neural network model provided for an embodiment of the application is provided.

[0051] Figure 5 A module diagram of a training device of a malware detector provided for an embodiment of the application is provided. DETAILED DESCRIPTION

[0052] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0053] The following detailed description is presented in order to describe the embodiments of the present disclosure and it is not intended that the present disclosure be limited thereof. The following detailed description is presented primarily for the purpose of enabling others, skilled in the art, to employ the present disclosure. It will be appreciated that the detailed description is not intended to limit the present disclosure to the particular form it is presented in. It is intended that the present disclosure covers all modifications, equivalents, and alternatives falling within the spirit and scope of the present disclosure as defined by the appended claims.

[0054] It is to be understood that the foregoing description is that of certain examples of the disclosure only, and that it is not to be taken in a limiting sense but is made merely for the purpose of providing some present preferred embodiments of the disclosure. It is therefore contemplated that the claims may, in some instances, be practiced without some of the specific features of the disclosure.

[0055] In addition, in the following description, numerous specific details are set forth in order to provide a thorough understanding of the examples. However, it will be apparent to one of ordinary skill in the art that the aspects described herein can be practiced without these specific details.

[0056] According to the research report of AV-TEST, a well-known anti-virus institution, more than 1.3 billion malware and programs were produced in 2021 only. Traditional signature-based detection methods are difficult to cover a large number of malware variants. Therefore, modern methods widely use deep learning technology to deal with such threats. Deep learning is a kind of machine learning technology that uses deep neural networks to solve problems, and its main feature is to use multiple nonlinear transformation structures to process and learn data. Deep neural network is a framework of deep learning, which is a neural network with at least one hidden layer. Similar to shallow neural networks, deep neural networks can model complex nonlinear systems at a higher level of abstraction, improving model capabilities. The main difference between shallow neural networks and deep neural networks is the number of hidden layers. Deep neural networks and shallow neural networks are collectively referred to as neural networks, and different depths of neural networks can be used for practical application scenarios according to different application requirements. Before using a neural network, the neural network needs to be trained to have good performance, improving the efficiency and accuracy of using the neural network to solve problems.

[0057] In training the neural network, the present application uses a gradient-based (gradient of the main network and the auxiliary network) adversarial attack method to convert the training samples into adversarial samples, and uses the training samples and the adversarial samples as training data together, so as to help the neural network to find and reduce the adversarial weakness in the parameter space as much as possible, and the attack method good at searching for adversarial weaknesses in the neural network can help the neural network to achieve better defense effect in adversarial training.

[0058] It should be noted that when training the neural network model, the neural network model parameters not mentioned below are set by the person skilled in the art.

[0059] Please refer to Figures 1 to 3 The training method of the malware detector comprises the following steps:

[0060] S10, obtaining a training data set, the training data set comprising a plurality of first feature vectors corresponding to a plurality of malicious application programs one by one, and a plurality of second feature vectors corresponding to a plurality of benign application programs one by one.

[0061] In this embodiment, the training data set is used as input data to train the neural network model to improve the performance of the neural network model.

[0062] The collection of the malicious application and the benign application is determined by the malware detector to be trained, if the malware detector to be trained is for mobile phone Android application, the malicious application and the benign application in the training data set are corresponding malicious application and benign application of Android application, if the malware detector to be trained is for computer window system application, the malicious application and the benign application in the training data set are corresponding malicious application and benign application of window system.

[0063] In the embodiment, the first feature vector and the second feature vector are both binary vectors, and are respectively used to represent the malicious application and the benign application. Specifically, the obtaining of the training data set includes the following steps.

[0064] S11, obtaining an application set, the application set including a plurality of malicious applications and a plurality of benign applications.

[0065] In the embodiment, Android applications are collected as experimental data, wherein the malicious applications (malicious Android applications) are collected from a public anti-virus website VirusShare, the benign applications (benign Android applications) are collected from a public Android application website AndroZoo, and the malicious applications and the benign applications are respectively collected 4000.

[0066] S12, extracting API calling information of each application in the application set, and collecting API calling information of all applications to obtain an API calling information set.

[0067] Specifically, a static analysis tool is used to decompile each application in the collected application set and extract API calling information of each application, and then API calling information corresponding to each application is collected to obtain an API calling information set.

[0068] For the convenience of understanding, by way of example, 4000 malicious applications and 4000 benign applications collected in the previous step are respectively decompiled, and API call information of each application is extracted, and the number of API call information in the API call information set is the sum of API call information corresponding to each application. It can be understood that, since each application is different, the number and type of API call information corresponding to each application are different, for example, the first malicious application in the 4000 malicious applications corresponds to 10 API call information, which are A1 to A10; the second malicious application corresponds to 3 API call information, which are A1, A6, and A12; the third malicious application corresponds to 5 API call information, which are A7, A8, A15, A17, and A18;..., the total number of API call information is 10+3+5+…, and since different applications may have the same type of API call information, the type of API call information must be less than the total number of API call information.

[0069] S13, based on the API call information set of the application set and the API call information of each application, obtaining a feature vector of each application, wherein the feature vector corresponding to the malicious application is a first feature vector, and the feature vector corresponding to the benign application is a second feature vector;

[0070] This step is used to convert each application into a feature vector. For the convenience of description, the feature vector corresponding to the malicious application is named as the first feature vector, and the feature vector corresponding to the benign application is named as the second feature vector. Based on the example above, in this embodiment, the number of the first feature vector and the number of the second feature vector are both 4000.

[0071] Step S13 includes:

[0072] S131, counting the number of occurrences of each API call information in the API call information set;

[0073] After all the API call information of all the collected Android applications is summarized, the occurrence times of each API call information are counted. For example, A1 to A10 are 10 API call information, each API call information can occur in multiple applications. If API call information A1 occurs in 400 applications, the API call information A1 is counted as 400 times. If API call information A2 occurs in 50 applications, the API call information A2 is counted as 50 times. In this way, the occurrence times of each API call information are counted.

[0074] In the embodiment, M is 4096, that is, the API feature dictionary includes 4096 API call information, and the occurrence times of the 4096 API call information are ranked in the top 4096 (in the order from large to small).

[0075] In the embodiment, M is 4096, that is, the API feature dictionary includes 4096 API call information, and the occurrence times of the 4096 API call information are ranked in the top 4096 (in the order from large to small).

[0076] Specifically, after the occurrence times of various API call information are counted in step S131, the top 4096 API call information are obtained to form the API feature dictionary. In one specific embodiment, the occurrence times of the counted API call information are sorted, and the API call information ranked in the top 4096 is selected according to the principle from large to small. In another specific embodiment, the API feature dictionary is obtained by at least 4096 times of selection. Specifically, the API call information with the most occurrence times is selected in the API call information set for the first time. After the selection, the API call information with the most occurrence times is selected in the remaining API call information set for the second time. After the selection, the API call information with the most occurrence times is selected in the remaining API call information set for the third time. And so on, until 4096 API call information are selected.

[0077] It should be noted that in the embodiment, M is 4096, which is an empirical data. The value of M can be determined by experience or experiment by those skilled in the art.

[0078] S133, extract the API call information of each application program, and convert each application program into a feature vector for representing the application program based on the comparison result of the API call information of each application program and the API feature dictionary. Each malicious application corresponds to a first feature vector, and each benign application corresponds to a second feature vector.

[0079] Specifically: using static analysis tools to decompile each application and extract API call information of each application.

[0080] In this step, after the API call information of one application is extracted and converted into a feature vector, the API call information of another application is extracted and converted into a feature vector; or, after the API call information of all applications is extracted, each API call information is converted into a feature vector in turn; or, the API call information of each application is extracted and converted into a feature vector at the same time, which is not limited here. This step is used to convert each application into a feature vector. There are 4096 kinds of API call information in the API feature dictionary. The API call information of each application is compared with the 4096 kinds of API call information in the API feature dictionary to obtain the feature vector of each application. The feature vector is a binary feature vector composed of 0 and 1, wherein 0 in the binary feature vector indicates that the target API call information does not exist in the API feature dictionary, and 1 in the binary feature vector indicates that the target API call information exists in the API feature dictionary, and the target API call information is any API call information in each application. In this embodiment, the dimension of the feature vector is 1xM, i.e., 1x4096.

[0081] For the convenience of understanding, an example is given. The 4096 kinds of API call information in the feature dictionary are A1\A3\A5……, and the process of converting each application into a binary feature vector can be as follows: judging whether the API call information ranked first (with the highest frequency of occurrence) in the feature dictionary appears in the application, if it appears, it is 1, if it does not appear, it is 0, then judging whether the API call information ranked second in the feature dictionary appears in the application, if it appears, it is 1, if it does not appear, it is 0, and in this order, whether the 4096 kinds of API call information appear in the application is judged, and finally a vector composed of 0 and 1 is obtained, such as (0, 1, 0, 1, 0, 0……)

[0082] When each application is converted into a binary feature vector, it can be processed in series or in parallel.

[0083] After this step, 4000 kinds of malicious applications are converted into 4000 first feature vectors with a dimension of 4096, and 4000 kinds of benign applications are converted into 4000 second feature vectors with a dimension of 4096. Each kind of malicious application and each kind of benign application corresponds to its feature vector one by one.

[0084] S14, the set of feature vectors of all applications is taken as a training data set, the training data set includes a plurality of first feature vectors corresponding to the plurality of malicious applications, and a plurality of second feature vectors corresponding to the plurality of benign applications one by one.

[0085] The plurality of first feature vectors corresponding to the plurality of malicious applications and the plurality of second feature vectors corresponding to the plurality of benign applications converted in step S13 are combined to form a training data set. The plurality of malicious applications and the plurality of benign applications in this step refer to all the malicious applications and the benign applications obtained in step S11.

[0086] Based on the data of the malicious applications and the benign applications obtained above, the training data set includes 4000 first feature vectors and 4000 second feature vectors.

[0087] S20, obtaining a first neural network model to be trained, and using the training data set to perform one-level iterative training on the backbone network of the first neural network model to be trained, to obtain a neural network model completing primary training, the total number of layers of the backbone network is N layers, N is a positive integer greater than 2;

[0088] In this step, the first neural network model to be trained is constructed, and then the training data set obtained in step S10 is used to perform iterative training on the backbone network of the first neural network model, to obtain a neural network model completing primary training. Each time of iterative training is to update the learnable parameters of the backbone network according to the output result, so as to improve the accuracy of application classification, that is, the accuracy of judging whether the application is a benign application or a malicious application. Specifically, the output result is the benign-malicious probability of each application, such as 【0.8, 0.2】, which represents that the probability of the application being a benign application is 0.8, which is greater than the probability of being a malicious application 0.2, so the application is a benign application. When the accuracy of the output result no longer increases, that is, it is infinitely close to the actual result, the iterative training is completed. For example, when judging whether 8000 applications are benign applications or malicious applications, the accuracy reaches 97.3%, and the accuracy is the highest accuracy, then the iterative training is completed.

[0089] Please refer to Figure 4 In this embodiment, the total number of layers of the backbone network used is 5 layers, which is composed of f 1 , f 2 , f 3 , f 4 , f 5 , wherein f 1 is a fully connected layer of 4096x128, f 2is a fully connected layer with 128x64, f 3 is a fully connected layer with 128x64, f 4 is a fully connected layer with 128x64, f 5 is a fully connected layer with 64x2;

[0090] is a fully connected layer with 64x2, f 1 is a fully connected layer with 64x2, f 4 is a fully connected layer with 64x2, f 5 is a fully connected layer with 64x2, f 1 is a fully connected layer with 64x2, f 2 is a fully connected layer with 64x2, f 3 is a fully connected layer with 64x2, f 4 is a fully connected layer with 64x2, f 1 is a fully connected layer with 64x2, f 2 is a fully connected layer with 64x2, f 3 is a fully connected layer with 64x2, f 4 is an intermediate feature vector output, x 5 is a softmax logits output by the backbone network, where the meanings of the two values respectively represent benign probability and malicious probability.

[0091] In this embodiment, when the backbone network of the first neural network model is trained using the training data set, the training of the backbone network is set as follows: epochs is 50, batch size is 128, learning rate is 0.001, and the optimizer used is Adam optimizer.

[0092] S30, the neural network model after primary training is constructed into a second neural network model to be trained including N-2 auxiliary networks, the auxiliary networks of the second neural network model to be trained are iteratively trained using the training data set, and a neural network model after secondary training is obtained; wherein the first layer to the N-2 layer of the backbone network are respectively provided with one auxiliary network, and the output ends of the first layer to the N-2 layer of the backbone network are respectively connected with the input ends of the N-2 auxiliary networks.

[0093] The total number of layers of the backbone network is N layers, which is composed of convolutional layers and fully connected layers. Preferably, the first layer to the N-2 layer of the backbone network are respectively constructed with one auxiliary network, the output dimension of the auxiliary network is consistent with the backbone network, if the corresponding intermediate layer of the auxiliary network is a convolutional layer, then the auxiliary network is composed of pooling, flatten, a plurality of fully connected layers and softmax activation function; if the corresponding intermediate layer of the auxiliary network is a fully connected layer, then the auxiliary network is composed of a plurality of fully connected layers and softmax activation function. The number of fully connected layers is determined by the actual situation, as long as the auxiliary network can fit the feature distribution of the intermediate layer.

[0094] In the embodiment, the total number of layers of the backbone network is 5, the intermediate layers from the 1st layer to the N-2th layer are f 1 2 3 , and all are fully connected layers. The auxiliary networks g 1 2 3 are trained for the intermediate layers of the backbone network. The auxiliary networks are all composed of a fully connected layer of 128x64 and a fully connected layer of 64x2. The outputs of the auxiliary networks g 1 2 3 are c 1 , c 2 , and c 3 respectively, and all are softmax logits, in which the meanings of the two values respectively represent benign probability and malicious probability. c 1 may represent the benign-malicious probability of the intermediate feature vector x 1 , c 2 may represent the benign-malicious probability of the intermediate feature vector x 2 , and c 3 may represent the benign-malicious probability of the intermediate feature vector x 3 . When the auxiliary networks g 1 2 3 are trained, the backbone network serves as a feature extractor, all parameters related to the backbone network remain constant and fixed, and all training techniques for the backbone network such as dropout technology need to be disabled. The training settings of the auxiliary networks are consistent with the training settings of the backbone network.

[0095] All auxiliary networks are trained using the training data set until convergence, and the parameters in the backbone network remain unchanged during the training.

[0096] S40, performing three-level iterative training on the neural network model completed by the secondary training using adversarial training data to obtain the malware detector, the adversarial training data is composed of a preset number of target first feature vectors and a preset number of target second feature vectors in the training data set, and an adversarial feature vector corresponding to each target first feature vector, the target first feature vector is any one first feature vector in the training data set, and the target second feature vector is any one second feature vector in the training data set, wherein

[0097] ​​​​​​​​The iteration update of the third-level iteration training includes: obtaining a preset number of target first feature vectors and a preset number of target second feature vectors, generating an adversarial feature vector of each target first feature vector according to the neural network model updated in the last iteration, updating the backbone network parameters of the neural network model updated in the last iteration according to all the target first feature vectors, target second feature vectors and adversarial feature vectors obtained, to obtain a neural network model updated in the current iteration, and if the first iteration end condition is not met, performing the next iteration update on the neural network model updated in the current iteration.

[0098] The step trains the neural network model using the adversarial training data to improve the defense capability of the trained neural network model, and the adversarial feature vector corresponding to the malicious software program in the adversarial training data is generated using the gradient of the backbone network and the auxiliary network, which increases the search for adversarial vulnerabilities in the intermediate layer, the generated adversarial feature vector contains more potential adversarial vulnerabilities from the intermediate layer, and better anti-interference capability can be obtained to improve the overall defense capability of the neural network.

[0099] In the embodiment, the third-level iteration training is set as follows: the learning rate is 0.001, and the Adam optimizer is used as the optimizer.

[0100] In the embodiment, the first iteration end condition is that the number of iterations of the third-level iteration training is 1875. The backbone network parameters updated in each iteration refer to the learnable parameters of the backbone network.

[0101] In the step of any iteration update of the third-level iteration training, the step of obtaining a preset number of target first feature vectors and a preset number of target second feature vectors specifically includes: selecting a preset number of first feature vectors from the training data set as target first feature vectors and a preset number of second feature vectors from the training data set as target second feature vectors based on a random selection rule. In the embodiment, the preset number is 64, which is empirical data, and a person skilled in the art can adjust the data.

[0102] The random selection rule for obtaining the target first feature vectors and the target second feature vectors can accelerate the convergence speed of the neural network model.

[0103] For the convenience of understanding, it is illustrated by example that, when the first iteration update is performed, 64 first feature vectors are randomly selected from the 4000 first feature vectors in the training data set as target first feature vectors, and 64 second feature vectors are randomly selected from the 4000 second feature vectors as target second feature vectors, when the second iteration update is performed, 64 first feature vectors and 64 second feature vectors are reselected from the training data set as target first feature vectors and target second feature vectors respectively, and the first feature vectors selected in the second time may be partially the same as or completely different from the first feature vectors selected in the first time; the second feature vectors selected in the second time may be partially the same as or completely different from the second feature vectors selected in the first time.

[0104] In the step of any iteration update in the third iteration training, the step of generating the adversarial feature vector of each target first feature vector according to the neural network model updated in the last iteration includes:

[0105] According to the neural network model updated in the last iteration, the obtained each target first feature vector is subjected to a preset number of iteration updates to obtain the adversarial feature vector of each target first feature vector, wherein any iteration update of the preset number of iteration updates includes:

[0106] The overall disturbance is calculated according to the input feature vector updated in the last iteration;

[0107] The disturbances of the plurality of intermediate layers of the backbone network are calculated based on the sum of the input feature vector updated in the last iteration and the overall disturbance, the plurality of intermediate layers of the backbone network being the first layer to the N-2 layer of the backbone network corresponding to the N-2 auxiliary networks; and the optimal disturbance corresponding to the updated input feature vector is obtained based on the disturbances of the plurality of intermediate layers of the backbone network and the overall disturbance;

[0108] The sum of the input feature vector updated in the last iteration and the optimal disturbance is taken as the adversarial feature vector updated in the current iteration;

[0109] If the second iteration end condition is not met, the adversarial feature vector updated in the current iteration is subjected to standardization processing to obtain an input feature vector updated in the current iteration, and is input to the neural network model updated in the last iteration for next iteration update.

[0110] Preferably, the second iteration end condition is that the preset number of iteration updates is reached, and the preset number is 100.

[0111] In this step, the multiple iteration update process corresponding to each of the target first feature vectors is generated, and the neural network model is the same. The corresponding neural network model for generating the adversarial feature vectors of the target first feature vectors obtained in different batches is different, and is the latest obtained neural network model.

[0112] For the convenience of understanding, the following is an example: the first iteration update corresponding to the three-level iteration training, the adversarial training data includes 64 target first feature vectors randomly selected for the first time, 64 target second feature vectors, and 64 adversarial feature vectors generated one by one corresponding to the 64 target first feature vectors, the neural network model corresponding to the first iteration update is the neural network model completed by the two-level training in step S30, wherein the generation process of any one of the adversarial feature vectors is as follows: the 64 target first feature vectors are input into the neural network model completed by the two-level training, and the first iteration is performed to obtain 64 target first feature vectors updated for the first time, the 64 target first feature vectors updated for the first time are standardized and then input into the neural network model completed by the two-level training, and the second iteration is performed to obtain 64 target first feature vectors updated for the second time, the 64 target first feature vectors updated for the second time are standardized and then input into the neural network model completed by the two-level training, and the next iteration is started, and when the iteration number reaches 100, the adversarial feature vector corresponding to each target first feature vector is obtained, and the adversarial feature vector is the target first feature vector updated for the 100th time; the adversarial training data is input into the neural network model completed by the two-level training, and the backbone network parameters of the neural network model completed by the two-level training are updated based on the output result to obtain the neural network model updated for the first time. The second iteration update corresponding to the three-level iteration training, the adversarial training data includes 64 target first feature vectors randomly selected for the second time, 64 target second feature vectors, and 64 adversarial feature vectors generated one by one corresponding to the 64 target first feature vectors, the neural network model corresponding to the second iteration update is the neural network model updated for the first time, and the generation method of any one of the adversarial feature vectors is the same as described above, and the difference is that the neural network model corresponding to the generation of the adversarial feature vector is the neural network model updated for the first time. The adversarial training data is input into the neural network model updated for the first time, and the backbone network parameters of the neural network model updated for the first time are updated based on the output result to obtain the neural network model updated for the second time. ……After the 1875th iteration update corresponding to the three-level iteration training is completed, the malware detector is obtained, and the neural network model updated for the 1875th time is the malware detector.

[0113] The step of calculating the overall perturbation according to the input feature vector updated in the last iteration comprises: inputting the input feature vector updated in the last iteration into the neural network model updated in the last iteration, and calculating the overall perturbation corresponding to each input feature vector updated in the last iteration based on the input feature vector updated in the last iteration, wherein the calculation formula of the overall perturbation is as follows:

[0114]

[0115] wherein δ f is the overall perturbation, f θ represents the backbone network, θ is the parameter of the backbone network, x represents the input feature vector input into the neural network model, y represents the label of x, y=0 represents that x is a second feature vector of a benign application program, and y=1 represents that x is a first feature vector of a malicious application program, L(f θ , x, y) represents a loss value calculated based on the label y. θ represents the gradient of the loss value with respect to the input x, and sign(·) represents a sign function, and ε represents a perturbation step length and is set to 0.01.

[0116] The step of calculating the perturbation of the plurality of intermediate layers of the backbone network based on the sum of the input feature vector updated in the last iteration and the overall perturbation comprises: inputting x+δ f as input data into the neural network model updated in the last iteration, and calculating the perturbation of the first layer to the N-2 layer (the intermediate layer corresponding to the N-2 auxiliary networks) of the backbone network. When N is 5, the data corresponding to the intermediate layer perturbation is 3.

[0117] The calculation formula of the perturbation of the intermediate layer is as follows:

[0118]

[0119] wherein δ l is the perturbation of the lth layer, represents a branch network from the input layer f 1 of the backbone network to the lth intermediate layer f 1 , and then to the output layer of the auxiliary network g l .

[0120] The intermediate layer perturbation set Δ={δ l | l∈[1, N-2]} can be obtained through the above formula, wherein N is the number of convolutional layers and fully connected layers in the backbone network.

[0121] ​The step of obtaining the optimal perturbation corresponding to the updated input feature vector based on the perturbation of the plurality of intermediate layers of the backbone network and the overall perturbation is specifically: obtaining the optimal perturbation corresponding to each target first feature vector based on all the intermediate layer perturbations δ l and the overall perturbation δ f . m ;

[0122] The calculation formula of the optimal perturbation δ m is as follows:

[0123]

[0124] wherein, represents the malicious probability of x'; δ f is the overall perturbation.

[0125] It can be understood that the plurality of intermediate layer perturbations δ f of the backbone network are calculated by using x+δ l in the last step, and the result of each perturbation in the plurality of intermediate layer perturbations δ f may not be as good as directly using the overall perturbation δ f , so when the optimal perturbation is selected, whether the overall perturbation δ m is the optimal perturbation needs to be considered.

[0126] The sum of the input feature vector updated by the last iteration and the optimal perturbation can be understood as taking x+δ m as the adversarial feature vector updated by the current iteration.

[0127] When the number of iterations is less than 100, the adversarial feature vector updated by the current iteration needs to be normalized and then input to the neural network model updated by the last iteration as an input feature vector to start the next iteration. Specifically, the normalization of the adversarial feature vector means that the value of each element in the vector is between 0 and 1. If the value of the element in the vector is between 0 and 1, no processing is needed. If the value is less than 0, the normalized value is 0. If the value is greater than 1, the normalized value is 1.

[0128] In this embodiment, the normalization of the adversarial feature vector means that the value of each element in the vector is 0 or 1. If the value of the element in the vector is between 0 and 1, the value is processed according to the rule of rounding off, for example, the value of the element is 0.4, the normalized value is 0, and the value of the element is 0.7, the normalized value is 1. If the value is less than 0, the normalized value is 0. If the value is greater than 1, the normalized value is 1.

[0129] In the process of generating the adversarial feature vector, the overall perturbation is fine-tuned using the output loss of the branch network, so that the generated adversarial feature vector contains more potential adversarial weaknesses from the intermediate layers. Training the neural network model using the adversarial feature vector as adversarial training data can obtain better anti-interference ability and improve the overall defense capability of the network.

[0130] The embodiments of the present application also provide a training device of a malware detector, and a schematic diagram of modules of the training device is shown in Figure 5 As shown in Figure 5 The device 100 includes:

[0131] The acquisition module 101 is configured to acquire a training data set, wherein the training data set includes a plurality of first feature vectors corresponding to a plurality of malicious applications and a plurality of second feature vectors corresponding to a plurality of benign applications.

[0132] The first training module 102 is configured to acquire a first neural network model to be trained, and perform one-level iterative training on a backbone network of the first neural network model to be trained using the training data set, to obtain a neural network model after primary training, wherein the total number of layers of the backbone network is N layers, and N is a positive integer greater than 2.

[0133] The second training module 103 is configured to construct the neural network model after primary training into a second neural network model to be trained including N-2 auxiliary networks, and perform two-level iterative training on the auxiliary networks of the second neural network model to be trained using the training data set, to obtain a neural network model after two-level training. The first layer to the N-2 layer of the backbone network are respectively provided with one auxiliary network, and the output ends of the first layer to the N-2 layer of the backbone network are respectively connected with the input ends of the N-2 auxiliary networks.

[0134] The third training module 104 is configured to perform third-level iterative training on the neural network model completed the second-level training by using adversarial training data to obtain the malware detector, the adversarial training data is composed of a preset number of target first feature vectors and a preset number of target second feature vectors in the training data set and an adversarial feature vector corresponding to each target first feature vector, the target first feature vector is any one first feature vector in the training data set, and the target second feature vector is any one second feature vector in the training data set, wherein any one iteration update of the third-level iterative training comprises the following steps: reacquiring a preset number of target first feature vectors and a preset number of target second feature vectors, obtaining an adversarial feature vector of each target first feature vector according to the neural network model updated in the last iteration, updating the backbone network parameters of the neural network model updated in the last iteration according to all the target first feature vectors, target second feature vectors and adversarial feature vectors obtained to obtain a neural network model updated in the current iteration, and if a first iteration end condition is not met, performing next iteration update on the neural network model updated in the current iteration.

[0135] Preferably, the obtaining module 101 is specifically configured to:

[0136] obtain an application set, the application set comprising a plurality of malicious applications and a plurality of benign applications;

[0137] extract API call information of each application in the application set, and collect API call information of all the applications to obtain an API call information set;

[0138] obtain a feature vector of each application based on the API call information set of the application set and the API call information of each application, wherein the feature vector corresponding to the malicious application is a first feature vector, and the feature vector corresponding to the benign application is a second feature vector;

[0139] collect the feature vectors of all the applications as a training data set, the training data set comprising a plurality of first feature vectors corresponding to the plurality of malicious applications and a plurality of second feature vectors corresponding to the plurality of benign applications.

[0140] Preferably, the obtaining module 101 is specifically configured to:

[0141] count the number of occurrences of each API call information in the API call information set;

[0142] An API feature dictionary is acquired, the API feature dictionary including the top M API call information in the API call information set in terms of occurrence frequency, M being a positive integer greater than 300;

[0143] API call information of each application program is extracted, and each application program is converted into a feature vector for representing the application program based on a comparison result of the API call information of each application program and the API feature dictionary, wherein the feature vector corresponding to each malicious application program is a first feature vector, and the feature vector corresponding to each benign application program is a second feature vector.

[0144] Preferably, the third training module 104 is further configured to:

[0145] The target first feature vector obtained is iteratively updated a preset number of times according to the neural network model updated last time, to obtain the adversarial feature vector of each target first feature vector, wherein any one of the preset number of iterations includes: calculating an overall perturbation according to the input feature vector updated last time; calculating the perturbations of the plurality of intermediate layers of the backbone network based on the sum of the input feature vector updated last time and the overall perturbation, the plurality of intermediate layers of the backbone network being the 1st layer to the N-2th layer of the backbone network corresponding to the N-2 auxiliary networks; obtaining the optimal perturbation corresponding to the updated input feature vector based on the perturbations of the plurality of intermediate layers of the backbone network and the overall perturbation; taking the sum of the input feature vector updated last time and the optimal perturbation as the adversarial feature vector updated this time; if the second iteration end condition is not met, normalizing the adversarial feature vector updated this time to obtain the input feature vector updated this time, and inputting the input feature vector updated this time to the neural network model updated last time for next iteration.

[0146] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described devices and modules can refer to the content in the foregoing method embodiments, which will not be described herein.

[0147] The application further provides a computer device, Figure 5 The training device shown can be disposed in the computer device. The computer device includes a memory, a processor, a communication interface, and a bus. The memory, the processor, and the communication interface are communicatively connected to each other through the bus. The computer device can include multiple processors to facilitate the functions of the different modules described above.

[0148] The memory can be a read-only memory, a static storage device, a dynamic storage device, or a random access memory. The memory can store executable code sequences, and when the executable code sequences stored in the memory are executed by the processor, the processor and the communication interface are used to execute the training method of the neural network provided by the embodiments of the present application. The memory can also include software modules and data required by other running processes such as operating systems. And the operating system can be LINUX, UNIX, WINDOWS, etc.

[0149] The processor can be a general central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), a graphics processing unit (GPU), or one or more integrated circuits.

[0150] The processor can also be an integrated circuit chip with a processing capability of signals. In the implementation process, part or all of the functions of the training method of the neural network of the present application can be completed by the integrated logic circuit of hardware in the processor or the instructions in the form of software. The processor described above can also be a general processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is mature in the art. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the training method of the malicious software detector of the present application.

[0151] The communication interface uses a transceiver module such as but not limited to a transceiver to realize the communication between the computer device and other devices or communication networks. For example, the communication interface can be any one or any combination of the following devices: a network interface (such as an Ethernet interface), a wireless network card, etc. A device with network access function.

[0152] The bus can include a path for communicating information among the various components of the computer device (e.g., the memory, the processor, the communication interface).

[0153] Each of the computer devices establishes a communication path through the communication network. Each of the computer devices is configured to implement part of the method for training the neural network according to the embodiments of the present application. Any of the computer devices can be a computer device (e.g., a server) in a cloud data center or a computer device in an edge data center.

[0154] The descriptions of the processes corresponding to the above-mentioned various figures each have their own focuses, and the parts not described in detail in a certain process can be referred to the related descriptions of other processes.

[0155] In the above embodiments, all or part of the steps can be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the steps can be implemented in the form of a computer program product. The computer program product for providing the data synchronization cloud service includes one or more computer instructions, and when the computer instructions are loaded and executed on a computer device, all or part of the processes or functions of the method for training the malware detector according to the embodiments of the present application are implemented.

[0156] The computer device can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center through a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) manner. The computer-readable storage medium stores computer program instructions for providing the data synchronization cloud service.

[0157] The embodiments of the present application also provide a storage medium, which is a non-volatile computer-readable storage medium. When the instructions in the storage medium are executed by a processor, the method for training the malware detector according to the embodiments of the present application is implemented.

[0158] The embodiments of the present application also provide a computer program product including instructions, which, when the computer program product is run on a computer, causes the computer to execute the method for training the malware detector according to the embodiments of the present application.

[0159] Those skilled in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or the program can instruct the related hardware to complete, and the program can be stored in a computer-readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk.

[0160] In the embodiments of the present application, the terms "first", "second" and "third" are only used for descriptive purpose and cannot be understood as indicating or implying relative importance. The term "at least one" means one or more, and the term "multiple" means two or more, unless otherwise explicitly limited.

[0161] The above is only optional embodiments of the present application, and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the concept and principle of the present application shall be included in the protection scope of the present application.

[0162] The above is a further detailed description of the present application in combination with specific preferred embodiments, and cannot be considered as limiting the specific implementation of the present application to these descriptions. For ordinary skilled persons in the technical field of the present application, a number of simple deductions and replacements can be made without departing from the concept of the present application, and all of them shall be considered as falling within the protection scope of the present application.

Claims

1. A training method for a malware detector, characterized in that, The method comprises the following steps: obtaining a training data set comprising a plurality of first feature vectors corresponding to a plurality of malicious applications and a plurality of second feature vectors corresponding to a plurality of benign applications; obtaining a first neural network model to be trained, and performing one-level iterative training on a backbone network of the first neural network model to be trained using the training data set to obtain a neural network model completing primary training, wherein the total number of layers of the backbone network is N layers, and N is a positive integer greater than 2; constructing the neural network model completing primary training into a second neural network model to be trained comprising N-2 auxiliary networks, and performing two-level iterative training on the auxiliary networks of the second neural network model to be trained using the training data set to obtain a neural network model completing two-level training, wherein the first layer to the N-2 layer of the backbone network are respectively provided with one auxiliary network, and the output ends of the first layer to the N-2 layer of the backbone network are respectively connected with the input ends of the N-2 auxiliary networks; performing three-level iterative training on the neural network model completing two-level training using adversarial training data to obtain the malware detector, wherein the adversarial training data is composed of a preset number of target first feature vectors and a preset number of target second feature vectors in the training data set, and an adversarial feature vector corresponding to each target first feature vector, the target first feature vector is any one of the first feature vectors in the training data set, and the target second feature vector is any one of the second feature vectors in the training data set, wherein any one iteration update of the three-level iterative training comprises: obtaining a preset number of target first feature vectors and a preset number of target second feature vectors, obtaining an adversarial feature vector of each target first feature vector according to the neural network model updated in the last iteration, updating the backbone network parameters of the neural network model updated in the last iteration according to all the target first feature vectors, target second feature vectors and adversarial feature vectors obtained to obtain the neural network model updated in the current iteration, and if the first iteration end condition is not met, performing the next iteration update on the neural network model updated in the current iteration. 2.The method of Claim 1, wherein, The step of obtaining the training data set comprises: obtaining an application set comprising a plurality of malicious applications and a plurality of benign applications; extracting API call information of each application in the application set, and collecting API call information of all applications to obtain an API call information set; based on the API call information set of the application set and the API call information of each application, obtaining a feature vector of each application, wherein the feature vector corresponding to the malicious application is a first feature vector, and the feature vector corresponding to the benign application is a second feature vector; The set of feature vectors of all the applications is taken as a training data set, which includes a plurality of first feature vectors corresponding to the plurality of malicious applications and a plurality of second feature vectors corresponding to the plurality of benign applications.

3. The method of claim 2, wherein, The step of obtaining the feature vector of each application based on the API call information set of the application set and the API call information of each application comprises: Counting the number of occurrences of each API call information in the API call information set; An API feature dictionary is obtained, which includes the first M API call information with the highest number of occurrences in the API call information set, and M is a positive integer greater than 300; The API call information of each application is extracted, and each application is converted into a feature vector representing the application based on the comparison result of the API call information of each application and the API feature dictionary, wherein the feature vector corresponding to each malicious application is a first feature vector, and the feature vector corresponding to each benign application is a second feature vector. 4.The method of Claim 1, wherein, The step of obtaining the adversarial feature vector of each target first feature vector according to the neural network model updated in the last iteration comprises: According to the neural network model updated in the last iteration, the obtained each target first feature vector is iteratively updated for a preset number of times to obtain the adversarial feature vector of each target first feature vector, wherein any one of the preset number of iterative updates comprises: Calculate the overall disturbance according to the input feature vector updated in the last iteration; Calculate the disturbance of the plurality of intermediate layers of the main network based on the sum of the input feature vector updated in the last iteration and the overall disturbance, the plurality of intermediate layers of the main network being the 1st layer to the N-2 layer of the main network corresponding to the N-2 auxiliary networks; Based on the disturbance of the plurality of intermediate layers of the main network and the overall disturbance, an updated input feature vector corresponding to the best disturbance is obtained; The sum of the input feature vector updated in the last iteration and the best disturbance is taken as the adversarial feature vector updated in the current iteration; If the second iteration end condition is not met, the adversarial feature vector updated in the current iteration is normalized to obtain an input feature vector updated in the current iteration, and is input into the neural network model updated in the last iteration for next iteration update.

5. A training apparatus of a malware detector, characterized by, The device comprises: An acquisition module is configured to acquire a training data set, which includes a plurality of first feature vectors corresponding to a plurality of malicious applications and a plurality of second feature vectors corresponding to a plurality of benign applications; A first training module is configured to acquire a first neural network model to be trained, and perform one-level iterative training on a main network of the first neural network model to be trained using the training data set to obtain a neural network model completing primary training, wherein the total number of layers of the main network is N layers, and N is a positive integer greater than 2. a second training module, configured to construct the neural network model after the primary training as a second neural network model to be trained including N-2 auxiliary networks, and perform secondary iterative training on the auxiliary networks of the second neural network model to be trained by using the training data set, to obtain a neural network model after the secondary training; wherein the first layer to the N-2 layer of the backbone network are respectively provided with one auxiliary network, and the output ends of the first layer to the N-2 layer of the backbone network are respectively connected with the input ends of the N-2 auxiliary networks; a third training module, configured to perform tertiary iterative training on the neural network model after the secondary training by using adversarial training data, to obtain the malware detector, the adversarial training data being composed of a preset number of target first feature vectors and a preset number of target second feature vectors in the training data set, and an adversarial feature vector corresponding to each target first feature vector, the target first feature vector being any one first feature vector in the training data set, and the target second feature vector being any one second feature vector in the training data set, wherein any one iteration update of the tertiary iterative training includes: reacquiring a preset number of target first feature vectors and a preset number of target second feature vectors, acquiring an adversarial feature vector of each target first feature vector according to the neural network model after the last iteration update, updating the backbone network parameters of the neural network model after the last iteration update according to all the target first feature vectors, target second feature vectors and adversarial feature vectors, to obtain a neural network model after the current iteration update, and if a first iteration end condition is not met, performing the next iteration update on the neural network model after the current iteration update.

6. The malware detector training apparatus of claim 5, wherein, The obtaining module is specifically configured to: obtain an application set, the application set including a plurality of malicious applications and a plurality of benign applications; extract API call information of each application in the application set, and obtain an API call information set by collecting the API call information of all the applications; obtain a feature vector of each application based on the API call information set of the application set and the API call information of each application, wherein the feature vector corresponding to the malicious application is a first feature vector, and the feature vector corresponding to the benign application is a second feature vector; collect the feature vectors of all the applications as a training data set, the training data set including a plurality of first feature vectors corresponding to the plurality of malicious applications and a plurality of second feature vectors corresponding to the plurality of benign applications.

7. The malware detector training apparatus of claim 6, wherein, The obtaining module is specifically configured to: count the number of occurrences of each API call information in the API call information set; obtain an API feature dictionary, the API feature dictionary including the first M API call information with the largest number of occurrences in the API call information set, M being a positive integer greater than 300. extract API calling information of each application program, and convert each application program into a feature vector for representing the application program based on a comparison result of the API calling information of each application program and the API feature dictionary, wherein the feature vector corresponding to each malicious application program is a first feature vector, and the feature vector corresponding to each benign application program is a second feature vector.

8. The apparatus of claim 5, wherein, The third training module is further configured to: perform a preset number of iteration updates on each target first feature vector based on the neural network model updated in the last iteration, to obtain the adversarial feature vector of each target first feature vector, wherein any one of the preset number of iteration updates comprises: calculating an overall perturbation based on the input feature vector updated in the last iteration; calculating a perturbation of each intermediate layer of the backbone network based on a sum of the input feature vector updated in the last iteration and the overall perturbation, wherein the intermediate layers of the backbone network are the first layer to the N-2 layer of the backbone network corresponding to the N-2 auxiliary networks; obtaining an optimal perturbation corresponding to the input feature vector updated based on the perturbations of the intermediate layers of the backbone network and the overall perturbation; taking a sum of the input feature vector updated in the last iteration and the optimal perturbation as the adversarial feature vector updated in the current iteration; if a second iteration end condition is not met, normalizing the adversarial feature vector updated in the current iteration to obtain an input feature vector updated in the current iteration, and inputting the input feature vector updated in the current iteration to the neural network model updated in the last iteration for next iteration update.

9. A computer device, comprising: The computer device comprises a processor and a memory, and the memory stores a computer program, and the computer device implements the method of any one of claims 1 to 4 when the processor executes the computer program.

10. A computer-readable storage medium, characterized in that, When the instructions in the computer readable storage medium are executed by the processor, the processor executes the method of any one of claims 1 to 4. When the instructions in the computer readable storage medium are executed by the processor, the processor executes the method of any one of claims 1 to 4.

Images