A method and system for cross-platform application anomaly detection based on transfer learning

Abstract

This invention discloses a method and system for anomaly detection in cross-platform applications based on transfer learning. It extracts feature files from the file to be tested, and after filtering the file content, converts the feature files into images using file visualization methods to represent the current file under test. Residual networks are used for classification, and transfer learning is applied to improve the learning of new tasks by transferring knowledge from previously learned related tasks. This addresses the shortcomings of most machine learning algorithms, which can only solve single tasks and have insufficient generalization ability, thus alleviating the contradiction between generalized models and personalized needs. This method can effectively identify the attributes of the file to be tested and effectively improves the shortcomings of current methods, such as poor generalization ability and the inability to solve only single tasks.

Description

Technical Field

[0001] This invention relates to malicious behavior detection technology using machine learning, specifically to a method and system for detecting anomalies in cross-platform applications based on transfer learning. Background Technology

[0002] Transfer learning is a term in machine learning that refers to the influence of one form of learning on another, or the impact of acquired experience on the performance of other activities. Transfer learning is widespread in the learning of various knowledge, skills, and social norms. It focuses on storing solutions to existing problems and applying them to other different but related problems. For example, knowledge (or models) used to identify cars can be used to improve the ability to identify trucks.

[0003] Convolutional Neural Networks (CNNs) are a class of feedforward neural networks that incorporate convolutional computations and have a deep structure. They are one of the representative algorithms of deep learning. CNNs possess representation learning capabilities and can perform translation-invariant classification of input information according to their hierarchical structure; therefore, they are also known as "Shift-Invariant Artificial Neural Networks (SIANNs)".

[0004] Residual networks, a type of convolutional neural network proposed by four researchers from Microsoft Research, won the ImageNet large-scale visual recognition competition in 2015 for both image classification and object recognition. Residual networks are characterized by their ease of optimization and the ability to improve accuracy by increasing their depth considerably. Their internal residual blocks use skip connections to mitigate the vanishing gradient problem that arises when increasing depth in deep neural networks.

[0005] In existing works based on transfer learning and residual networks, such as the scene classification method based on residual network training using transfer learning disclosed in CN109784237A, the problem of training failure when the neural network algorithm is too deep is addressed by transferring an ImageNet-based residual network model and adding a quadratic layer. In the mushroom image recognition method and apparatus based on deep residual networks and transfer learning disclosed in CN110781921A, an ImageNet-based residual network model is also used as the base model, and the final fully connected layer is replaced with an 18-label fully connected layer to identify mushroom images. In the high-resolution remote sensing image classification method based on residual networks and transfer learning disclosed in CN112836614A, images in a high-resolution remote sensing image database are filtered to classify source and target domain datasets. The base model is trained using the source domain dataset, and the last layer of the residual network is replaced with a fully connected layer with a defined number of labels, thus enabling scene classification of high-resolution remote sensing images. Summary of the Invention

[0006] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies and provide a cross-platform application anomaly detection method and system based on transfer learning. By leveraging the high classification performance of convolutional networks and the advantages of transfer learning in multi-task processing and model generalization, software is transformed into image features. The aim is to improve training effectiveness and efficiency, enabling a single model to handle multiple tasks and enhance the model's generalization ability.

[0007] Technical solution: The present invention provides a cross-platform application anomaly detection method based on transfer learning, comprising the following steps:

[0008] Step 1: Identify the file type of the file to be tested (e.g., Android software and smart contracts) by checking whether the input file is a compressed file;

[0009] Step 2: If the file to be tested is an Android installation software sample, then decompress the Android installation file, filter out the .dex files by matching the file extensions, and then obtain the required parts through the pruning algorithm;

[0010] If the file to be tested is a smart contract sample, then obtain the smart contract's bytecode file;

[0011] The preprocessed files are then converted into images using file visualization methods, and these images are used as input for training the ResNet-50 network model.

[0012] Step 3: Convert the sample files on the Windows platform into images using file visualization methods;

[0013] Step 4: By using image similarity algorithms and dynamic thresholding algorithms, the difference between sample images on the Windows platform and sample images on the test file platform is reduced, thereby improving the model's generalization ability.

[0014] Step 5: First, train the ResNet-50 network model using samples from the Windows platform. The network model uses a residual network. After training, save the relevant parameters of the model.

[0015] Step 6: Apply the ResNet-50 network model trained in Step 5 to the malicious behavior detection of the file under test using transfer learning;

[0016] The specific methods for document visualization in steps 2 and 3 are as follows:

[0017] Read the corresponding file content; group every three hexadecimal characters in the file content and identify them as the three channels R, G, and B in the color system, then convert them using the following formula:

[0018] color=(blue&0x0000FF)|(green&0x00FF00)|(red&0xFF0000)

[0019] In this context, blue, green, and red represent the first, second, and third characters of the hexadecimal character set, respectively, and | is the bitwise operator.

[0020] Furthermore, taking the Android platform as an example, the specific steps of step 2, which obtains the required part through a pruning algorithm, are as follows:

[0021] (a) Obtain the header part of the .dex file, that is, bits 0 to 112 of the file content;

[0022] (b) Based on the starting position and size of the other parts provided in the header section, write the contents of the six middle parts, namely string_ids, type_ids, proto_ids, field_ids, method_ids and class_defs, into a new file.

[0023] Furthermore, the steps in step 4 for calculating image similarity and determining the dynamic threshold are as follows:

[0024] Step 4.1: Obtain all images from the Windows platform domain to be compared and the test platform domain, and denote them as Domain 1 and Domain 2 respectively;

[0025] Step 4.2: Calculate the image hist similarity between each image in domain 1 and each image in domain 2.

[0026] First, calculate the grayscale histogram of the image:

[0027]

[0028] Where r k It represents the grayscale level of a pixel, n k It has grayscale r k The number of pixels, MN is the total number of pixels in the image;

[0029] Then calculate the hist similarity:

[0030]

[0031] Where G and S are histograms, and N is the number of color space samples;

[0032] Once completed, the threshold is calculated as follows:

[0033]

[0034] Where, x i For the i-th image in domain 1, y j Let m be the j-th image in domain 2, m be the number of images in domain 1, and n be the number of images in domain 2.

[0035] Step 4.3: Based on the threshold calculated in Step 4.2 and the image hist similarity data, delete the images in Domain 1 whose image similarity is less than the threshold.

[0036] Furthermore, the parameters of the residual network in step 5 are:

[0037] Activation function: ReLU = max(0, w) T x+b)

[0038] Among them, w T Let x be the transpose of the interlayer weight matrix, x be the input vector, and b be the interlayer bias.

[0039] Classification function:

[0040] Among them, z k Let C be the output value of the k-th node, and C be the number of output nodes, i.e., the number of categories.

[0041] Loss function:

[0042] Where y is the actual label value. The predicted probability value.

[0043] Furthermore, the transfer learning steps described in step 6 are as follows:

[0044] Step 6.1: Load the ResNet-50 model saved in Step 5 as the base model;

[0045] Step 6.2: Replace the last fully connected layer of the base model with a linear layer. This fixes the features of the representation layer of the pre-trained model and trains the classifier only with supervised data, thereby utilizing the knowledge in the base model and improving training efficiency. Since it is necessary to identify whether the attributes of the test file are benign or malicious, the number of output branches is modified to 2, outputting the probabilities of the two attributes. The classification function uses the softmax function, while keeping the parameters of other layers of the network unchanged.

[0046] Step 6.3: Use samples from the platform under test for training and testing.

[0047] The present invention also discloses a system for implementing a cross-platform application anomaly detection method based on transfer learning, comprising a feature extraction module, a pre-training module, and a transfer learning module;

[0048] The feature extraction module is used to extract feature files from the file to be tested, thereby obtaining the image features of the file to be tested.

[0049] The pre-training module uses image features from the Windows platform domain to train the network, obtains a base model, and saves the model's parameters and network structure.

[0050] The transfer learning module uses the base model of the pre-trained module and fine-tunes the network structure to obtain a new model based on the base model. This new model is then used for training and prediction in the target domain.

[0051] Beneficial effects: Compared with the prior art, the beneficial effects of the present invention are as follows:

[0052] 1. This invention improves the feature extraction strategy in the original malware detection by using images as a representation of the software. It does not rely on manual extraction and prior knowledge, and can effectively cope with the resistance brought to the detection process by obfuscation and packing techniques.

[0053] 2. This invention uses image similarity algorithm and dynamic threshold algorithm to reduce the gap between the source domain and the target domain and improve the generalization ability of the model.

[0054] 3. This invention uses the idea of ​​transfer learning, which enables the model to have certain performance after one training, greatly reducing the time for subsequent training, improving training efficiency, and ensuring high accuracy. Attached Figure Description

[0055] Figure 1 This is a flowchart illustrating the process of extracting image features from a document under test according to the present invention.

[0056] Figure 2 This is a flowchart illustrating the image similarity algorithm and dynamic threshold algorithm used in this invention;

[0057] Figure 3 This is a flowchart illustrating the transfer learning process for training the base model and applying the base model in this invention. Detailed Implementation

[0058] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0059] This invention improves existing machine learning training methods by employing a transfer learning algorithm. First, it extracts the required feature files from smart contracts or Android software samples (hereinafter referred to as test files). After filtering the file content, it converts the files into images using file visualization methods to represent the test files. Then, it uses a residual network as a type of convolutional network, achieving first place in the ImageNet competition for image classification, demonstrating excellent classification performance. Simultaneously, it applies transfer learning to improve the learning of new tasks by transferring knowledge from previously learned related tasks. This addresses the shortcomings of most machine learning algorithms, which can only solve single tasks and have insufficient generalization ability, thus alleviating the contradiction between generalized models and personalized needs. This method can effectively identify the attributes of test files and effectively improve the shortcomings of current methods, such as poor generalization ability and the inability to solve only single tasks.

[0060] like Figure 1 As shown, the specific process of cross-platform application anomaly detection based on transfer learning in this embodiment is as follows:

[0061] Step 1: Identify the file type of the file to be tested by checking whether the input file is a compressed file;

[0062] Step 2: If the file to be tested is an Android software sample, the Android installation file is decompressed, and the .dex files are filtered out by matching file extensions. Then, the required parts are obtained through a pruning algorithm. If the file to be tested is a smart contract, the bytecode file of the smart contract is obtained. Then, the preprocessed file to be tested is converted into an image using a file visualization method, and the converted image is used as the input for the subsequent training of the ResNet-50 model.

[0063] Step 2.1 Obtain the header portion of the .dex file, which is bits 0 to 112 of the file content.

[0064] Step 2.2 Based on the starting position and size of the other parts provided in the header section, write the contents of the six middle parts, namely string_ids, type_ids, proto_ids, field_ids, method_ids, and class_defs, into a new file;

[0065] Step 3: Convert the samples from the Windows platform into images using file visualization methods;

[0066] Read the corresponding file content; group every three hexadecimal characters in the file content and identify them as the three channels R, G, and B in the color system, then convert them using the following formula:

[0067] color=(blue&0x0000FF)|(green&0x00FF00)|(red&0xF0000)

[0068] Where blue, green, and red are the first, second, and third characters of the hexadecimal character set, respectively, and | is the bitwise operator;

[0069] Step 4, as follows Figure 2 As shown, here we use image similarity algorithm and dynamic threshold algorithm to narrow the gap between sample images on the Windows platform and sample images on the test platform, thereby improving the generalization ability of the model.

[0070] Step 4.1 Obtain all images in the Windows platform domain and the test platform domain to be compared, denoted as Domain 1 and Domain 2.

[0071] Step 4.2 Calculate the image hist similarity between each image in domain 1 and each image in domain 2:

[0072] First, calculate the grayscale histogram of the image:

[0073]

[0074] Where r k It represents the grayscale level of a pixel, n k It has grayscale r k The number of pixels, MN is the total number of pixels in the image;

[0075] Then calculate the hist similarity:

[0076]

[0077] Where G and S are histograms, and N is the number of color space samples;

[0078] Once completed, the threshold is calculated as follows:

[0079]

[0080] Where x i For the i-th image in domain 1, y j Let m be the j-th image in domain 2, m be the number of images in domain 1, and n be the number of images in domain 2.

[0081] Step 4.3 Based on the threshold and image similarity data calculated in Step 2, delete images in Domain 1 whose image similarity is less than the threshold to reduce the gap between the two domains.

[0082] Steps 5 and 6 are as follows Figure 3 As shown.

[0083] Step 5: First, train the ResNet-50 model using samples from the Windows platform. After training, save the model's parameters. The parameters of the residual network are:

[0084] Activation function: ReLU = max(0, w) T x+b)

[0085] Where w T Let be the transpose of the interlayer weight matrix, x be the input vector, and b be the interlayer bias.

[0086] Classification function:

[0087] Among them, z k is the output value of the k-th node, and C is the number of output nodes, i.e. the number of categories.

[0088] Loss function:

[0089] Where y is the actual label value. The predicted probability value

[0090] Step 6: Apply the model to the software detection of the platform under test using transfer learning;

[0091] Step 6.1 Load the ResNet-50 model saved in Step 5 as the base model;

[0092] Step 6.2 Replace the last fully connected layer of the base model with a linear layer. This fixes the features of the representation layer of the pre-trained model and trains the classifier only with supervised data, thereby utilizing the knowledge in the base model and improving training efficiency. Since it is necessary to identify whether the attributes of the test file are benign or malicious, the number of output branches is modified to 2, outputting the probabilities of the two attributes. The classification function uses the softmax function, while keeping the parameters of other layers of the network unchanged.

[0093] Step 6.3 Use samples from the platform under test for training and testing.

[0094] Compared with the prior art, the present invention differs in the following ways: (1) the input data is filtered to reduce redundant information in the image, reduce the image size, and improve training efficiency; (2) domain data with similar attributes to the target task is used as the training set of the model before transfer, which can improve the training efficiency of the model in subsequent training; (3) considering the difference between the source domain and the target domain before and after transfer, the image similarity algorithm is used to reduce the gap between the source domain and the target domain. After transfer, the model knowledge of the source domain can be utilized to the maximum extent, and only the last linear layer needs to be trained to achieve a good classification effect, thereby reducing time overhead.

[0095] To verify the effectiveness of this invention, the Microsoft Msm dataset and the Android malware dataset were used for training and testing in the final prediction results. The results show that the accuracy can reach 95%. Furthermore, after using transfer learning, the best results can be achieved within five trials, which is 50% higher than without transfer learning. This demonstrates that the method proposed in this invention can improve training efficiency and reduce training time while maintaining accuracy.

Claims

1. A method for anomaly detection in cross-platform applications based on transfer learning, characterized in that: Includes the following steps: Step 1: Identify the file type of the file to be tested by checking whether the input file is a compressed file; Step 2: If the file to be tested is an Android installation software sample, then decompress the Android installation file, filter out the .dex files by matching the file extensions, and then obtain the required parts through the pruning algorithm; If the file to be tested is a smart contract sample, then obtain the smart contract's bytecode file; The preprocessed files are then converted into images using file visualization methods, and these images are used as input for training the ResNet-50 network model. Step 3: Convert the sample files on the Windows platform into images using file visualization methods; Step 4: Narrow the gap between sample images from the Windows platform and sample images from the test file platform using image similarity and dynamic threshold algorithms. The specific methods for calculating image similarity and determining the dynamic threshold are as follows: Step 4.1: Obtain all images from the Windows platform domain to be compared and the test platform domain, and denote them as Domain 1 and Domain 2 respectively; Step 4.2: Calculate the image hist similarity between each image in domain 1 and each image in domain 2. First, calculate the grayscale histogram of the image: Where r k It represents the grayscale level of a pixel, n k It has grayscale r k The number of pixels, MN is the total number of pixels in the image; Then calculate the hist similarity: Where G and S are histograms, and N is the number of color space samples; The threshold is then calculated as follows: Where, x i For the i-th image in domain 1, y j Let m be the j-th image in domain 2, m be the number of images in domain 1, and n be the number of images in domain 2. Step 4.3: Based on the threshold calculated in Step 4.2 and the image hist similarity data, delete the images in Domain 1 whose image similarity is less than the threshold; Step 5: First, train the ResNet-50 network model using samples from the Windows platform. The network model uses a residual network. After training, save the relevant parameters of the model. The parameters of the residual network are: Activation function: ReLU = max(0, w) T x+b) Where ww is the transpose of the interlayer weight matrix, x is the input vector, and b is the interlayer bias; Classification function: Among them, z k Let C be the output value of the k-th node, and C be the number of output nodes, i.e., the number of categories. Loss function: Where y is the actual label value. The predicted probability value. Step 6: Apply the ResNet-50 network model trained in Step 5 to malware detection using transfer learning; The specific methods for document visualization in steps 2 and 3 are as follows: Read the corresponding file content; group the file content into sets of three hexadecimal characters, and assign each set of characters to the R, G, and B channels in the color system. Convert the data using the following formula: color=(blue&0x0000FF)|(green&0x00FF00)|(red&0xFF0000) In this context, blue, green, and red represent the first, second, and third characters of the hexadecimal character set, respectively, and | is the bitwise operator.

2. The cross-platform application anomaly detection method based on transfer learning according to claim 1, characterized in that: The specific steps of obtaining the required part through the pruning algorithm in step 2 are as follows: (a) Obtain the header part of the .dex file. The header part refers to bits 0 to 112 of the file content. (b) Based on the starting position and size of the other parts provided in the header section, write the contents of the six middle parts, namely string_ids, type_ids, proto_ids, field_ids, method_ids and class_defs, into a new file.

3. The cross-platform application anomaly detection method based on transfer learning according to claim 1, characterized in that: The transfer learning steps described in step 6 are as follows: Step 6.1: Load the residual network model saved in Step 5 as the base model, and use ResNet-50 as the base model; Step 6.2: Replace the last fully connected layer of the base model with a linear layer, change the number of branches in the output to 2, and output the probabilities of the two attributes; use the softmax function for classification and keep the parameters of other layers of the network unchanged; Step 6.3: Use samples from the platform under test for training and testing.

4. A system for implementing the cross-platform application anomaly detection method based on transfer learning as described in any one of claims 1 to 3, characterized in that: It includes a feature extraction module, a pre-training module, and a transfer learning module; The feature extraction module is used to extract feature files from the file to be tested, thereby obtaining the image features of the file to be tested. The pre-training module uses image features from the Windows platform domain to train the network, obtains a base model, and saves the model's parameters and network structure. The transfer learning module uses the base model of the pre-trained module and fine-tunes the network structure to obtain a new model based on the base model. This new model is then used for training and prediction in the target domain.

Images