A method, apparatus, device, and readable storage medium for classifying malware.

Abstract

This application provides a method, apparatus, device, and readable storage medium for classifying malware. The method involves extracting candidate words based on all malware categories from a training set; calculating feature weights for all candidate words and selecting a feature word library based on these weights; extracting features from all ASM files using the feature word library to obtain feature maps of the ASM files; and classifying the feature maps using a trained convolutional neural network. By implementing this solution, the method calculates feature weights for malware candidate words, extracts features from ASM files of malware based on these weights, and finally classifies the malware using a convolutional neural network. This improves the accuracy of feature extraction while achieving efficient malware classification.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a method, apparatus, device, and readable storage medium for classifying malware. Background Technology

[0002] As the economic losses caused by malware increase year by year, malware classification has become increasingly important. Research on malware classification can be broadly divided into three parts: data processing, feature extraction, and classifier design. Among these, feature processing and classifier design are the most important technical means, while data processing is the method used throughout. In the feature extraction stage, features with high information gain should be selected as much as possible. The quality of feature extraction directly affects the classification results. In recent years, static feature extraction of malware has mainly been based on features such as byte sequences, readable strings, file header information, entropy, and dynamic link libraries. Machine learning or deep learning is then used to train and classify these features.

[0003] Schultz et al. were the first to introduce the N-gram extraction method into malware feature extraction. They first converted the bytes of the malicious file into hexadecimal, then divided them into multiple byte sequences, and then used ngram for extraction. The results were fed into various classifiers for training, proving that this method is better than the simple signature-based method.

[0004] Jiang Yongkang et al. converted the assembly instructions of malicious code into image vectors. This model achieved a cross-validation accuracy of 97.87% on the Microsoft BIG2015 dataset.

[0005] Xu Xuanji et al. and Yang Chunyu et al. used a method of fusing multiple features to detect malware, which was more effective than using a single feature extraction method.

[0006] Among feature weighting algorithms, the most classic is the TF-IDF algorithm proposed by Salton et al., which consists of term frequency (TF) and inverse document frequency (IDF). Its main idea is that the higher the frequency of a feature in a document, and the fewer documents containing that feature, the greater the discriminative power of the feature for classification. However, this method has a drawback: it does not utilize label information and is an unsupervised feature weighting method. Summary of the Invention

[0007] This application provides a method, apparatus, device, and readable storage medium for classifying malware, which can at least solve the problems of cumbersome malware classification process and unclear classification effect in related technologies.

[0008] The first aspect of this application provides a method for classifying malware, including:

[0009] Candidate words are extracted from the training set based on all malware categories;

[0010] Calculate feature weights for all candidate words and select a feature word library based on the feature weights;

[0011] Feature extraction is performed on all ASM files using the aforementioned feature vocabulary to obtain feature maps of the ASM files;

[0012] The feature maps are classified using a trained convolutional neural network.

[0013] A second aspect of this application provides a malware classification apparatus, comprising:

[0014] The extraction module is used to extract candidate words based on all malware categories on the training set;

[0015] The calculation module is used to calculate the feature weights of all the candidate words and select a feature word library based on the feature weights;

[0016] The acquisition module is used to extract features from all ASM files using the feature vocabulary to obtain the feature maps of the ASM files;

[0017] A classification module is used to classify the feature maps using a trained convolutional neural network.

[0018] A third aspect of this application provides an electronic device, characterized in that it includes a memory and a processor, wherein the processor is configured to execute a computer program stored in the memory, and the processor executes the computer program in accordance with the steps of the malware classification method provided in the first aspect of this application.

[0019] The fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements the steps of the malware classification method provided in the first aspect of this application.

[0020] As can be seen from the above, according to the malware classification method, apparatus, device, and readable storage medium provided in this application, candidate words are extracted from the training set based on all malware categories; feature weights are calculated for all candidate words, and a feature word library is selected based on the feature weights; features are extracted from all ASM files using the feature word library to obtain feature maps of the ASM files; and the trained convolutional neural network is used to classify the feature maps. Through the implementation of this application, by calculating the feature weights of malware candidate words, extracting features from ASM files of malware based on the feature weights, and finally classifying malware using a convolutional neural network, the accuracy of feature extraction is improved while achieving efficient malware classification. Attached Figure Description

[0021] Figure 1 This is a basic flowchart illustrating the malware classification method provided in the first embodiment of this application;

[0022] Figure 2 A schematic diagram of the confusion matrix for classifier classification provided in the first embodiment of this application;

[0023] Figure 3 A detailed flowchart illustrating the malware classification method provided in the second embodiment of this application;

[0024] Figure 4 A schematic diagram of the program modules of the malware classification device provided in the third embodiment of this application;

[0025] Figure 5 This is a schematic diagram of the structure of an electronic device provided in the fourth embodiment of this application. Detailed Implementation

[0026] To make the inventive objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] To address the problem that character-level compression in related technologies severely limits the compression ratio, the first embodiment of this application provides a method for classifying malware, such as... Figure 1 This is a basic flowchart of the malware classification method provided in this embodiment. The malware classification method includes the following steps:

[0028] Step 101: Extract candidate words based on all malware categories on the training set.

[0029] Specifically, in this embodiment, the ASM file contains candidate words such as push, mov, cmp, and various other English fields. Since there are also some hexadecimal fields in the ASM file, such as BD and E3, which may be misjudged as English words, this paper uses regular expressions to extract only words with a length greater than or equal to 3, and extracts 300 high-frequency candidate words for each category on the training set.

[0030] In an optional implementation of this embodiment, before the step of extracting candidate words based on all malware categories on the training set, the method further includes: extracting labeled data samples from the dataset; and randomly dividing the labeled data samples into training set and test set according to malware category.

[0031] Specifically, in this embodiment, the dataset is the Big2015 dataset released by Microsoft on the Kaggle platform in 2015. This dataset has become a benchmark dataset for malware researchers and is widely cited. Each sample in the dataset contains two types of files: an ASM file generated by disassembling using IDA tools, and a byte file represented in hexadecimal. The dataset contains 10,873 unlabeled samples and 10,868 labeled samples. There are a total of 9 malware categories in the dataset, and the name, number, and labels of each category are shown in Table 1. The 10,868 labeled data points were randomly divided into a training set (80%) and a test set (20%) according to their categories.

[0032] Table 1. Sample categories, number of samples, and labels in the BIG2015 dataset.

[0033]

[0034] Step 102: Calculate the feature weights for all candidate words and select the feature word library based on the feature weights.

[0035] Specifically, in this embodiment, an improved feature weighting method is used to calculate the feature weights of candidate words for each malware category using the labeled information, merge and remove duplicates, and then sort them in descending order, taking the top 256 candidate words as the feature word library.

[0036] In one optional implementation of this embodiment, the step of calculating the feature weights of all candidate words includes: counting 1-gram candidate words in each malware category on the training set; analyzing a candidate word a and calculating the probability PA of candidate word a appearing in the dataset; calculating the probability PB of candidate word a appearing in a category C; and calculating the feature weights of candidate word a based on PA and PB.

[0037] Specifically, in this embodiment, N-gram is a language model commonly used in large-vocabulary continuous speech recognition in NLP (Natural Language Processing)

[14] . Its basic idea is to perform a sliding window operation of size N on the content of the text according to bytes, forming a sequence of byte segments of length N. Each byte segment is a gram, and the frequency of occurrence of all grams is counted. The commonly used ones are bigram and trigram. When a sample consisting of 256 characters is extracted by bigram, a maximum of 65,536 words will be generated. When the Trigram is extracted, 16,777,216 words will be generated. The feature extraction time accounts for more than 90% of the total time. In addition, the dataset is very large, so this method will be very slow. 1-gram is a special case of N-gram. At this time, the sliding window N is 1, which can be directly understood as counting the number or frequency of a single word. Therefore, this invention directly uses the improved 1-gram to extract candidate words from ASM files. First, a certain number of 1-gram candidate words for each malware category are collected on the training set. Then, for a candidate word 'a', the probability PA of its occurrence in the dataset is calculated:

[0038]

[0039] Where, N a Let N be the number of times 'a' appears in the dataset. D Let be the number of samples in the dataset; then, calculate the probability PB of candidate word a appearing in a category C:

[0040]

[0041] Among them, C a Let N be the number of times 'a' appears in C. C Let C be the number of samples; finally, calculate the feature weights of candidate word a based on PA and PB, and the calculation formula is expressed as:

[0042]

[0043] The Weight(a) calculated by the above formula is the feature weight of candidate word a. This weight represents the discriminative power of candidate word as a feature in category C. The higher the discriminative power, the more suitable a is as a feature word.

[0044] In one optional implementation of this embodiment, the step of selecting a feature word library based on feature weights includes: merging the feature weights of all malware categories and then deduplicating all feature weights; sorting the remaining feature weights after deduplication of candidate words in descending order; and selecting the top N candidate words as the feature word library.

[0045] Specifically, in this embodiment, after calculating the feature weights of all candidate words, candidate words for all malware categories are merged, and duplicate candidate words are removed. Then, they are sorted in descending order according to their feature weights, as shown in Table 2. The first 256 candidate words are taken as the feature vocabulary, i.e., the feature vectors described below. It should be understood that, based on experimental results, a feature vector of length 80 achieves good results. The reason for choosing a length of 256 is to accommodate the requirements of the input graph to the CNN. Furthermore, in future work, the feature length can be increased through other means to enhance the robustness of the model.

[0046] Table 2. Weights of the top-weighted feature words

[0047]

[0048] Step 103: Extract features from all ASM files using the feature vocabulary library to obtain feature maps of the ASM files.

[0049] Specifically, in this embodiment, although each sample in the dataset contains two types of files, one is an ASM file generated by disassembling with IDA tools, and the other is a byte file represented in hexadecimal, this invention only extracts features from the ASM files of malware. It extracts features from all ASM files using the feature word library, counts the number of times the words in the features appear, and then rounds and standardizes the data.

[0050] In one optional implementation of this embodiment, the step of extracting features from all ASM files using a feature dictionary to obtain feature maps of ASM files includes: extracting features from all ASM files using a feature dictionary to obtain the maximum and minimum values ​​of the feature vectors; standardizing the maximum and minimum values ​​of the feature vectors according to the input requirements data of the convolutional neural network and the image visualization requirements data; and converting the standardized feature vectors into grayscale images.

[0051] Specifically, in this embodiment, the grayscale image converted from the feature vector is the feature map of the ASM file. The (max,min) normalization method is used to first obtain the maximum and minimum values ​​in a feature vector, and then normalize it to meet the input data requirements of the convolutional neural network and the image visualization requirements. Finally, the feature vector of length 256 is converted into a 16*16 grayscale image, which serves as the feature map of a single ASM file and is fed into the CNN for training.

[0052] Step 104: Classify the feature maps using the trained convolutional neural network.

[0053] Specifically, in this embodiment, the convolutional neural network (CNN) is a deep learning model based on a feedforward neural network, providing an end-to-end learning model. The parameters in the model can be trained using the traditional gradient descent method. The trained CNN can learn the features in the image and complete the extraction and classification of image features. CNN performs deep learning and reduces parameters through convolution and pooling operations. The first layer is the input layer, there are several hidden layers in the middle, and the last layer is the output layer, which outputs the classification result.

[0054] In one optional implementation of this embodiment, the step of classifying the feature map using the trained convolutional neural network includes: dividing the trained convolutional neural network into convolutional layers, activation layers, pooling layers, and fully connected layers using a CNN classifier; classifying the feature map using the convolutional layers, activation layers, and pooling layers; and after classifying the feature map using the trained convolutional neural network, further including: outputting the classification result of the feature map through a fully connected layer.

[0055] Specifically, in this embodiment, the CNN classifier divides the convolutional neural network into convolutional layers, activation layers, pooling layers, and fully connected layers. The first three layers perform convolution, activation, and pooling on the input data three times, and perform deep learning and parameter reduction operations to classify the feature maps. Finally, the fully connected layer outputs the classification result of the feature maps. It should be noted that, as... Figure 2The confusion matrix for classifier classification is shown. The vertical axis (0-8) represents the true labels of the samples, and the horizontal axis (0-8) represents the classification results of the classifier. Any point in the graph represents the frequency at which the true label and test label of a certain class of test data are equal. The data in this image has been normalized; the sum of the data in each row is 1, representing the total number of data points with that true label (due to using only two significant digits, there is a 0.01 error). The color bars on the right represent the frequency; the closer to 1, the darker the color, and the closer to 0, the lighter the color. Using the confusion matrix to evaluate the classifier's performance generally indicates a better classifier if the data is more concentrated on the diagonal, and a worse classifier if the data is more dispersed. For example, when the true labels are 1, 2, 3, 4, 6, and 8, the frequency of predicted labels also being 1, 2, 3, 4, 6, and 8 is 1, meaning almost all data with labels 1, 2, 3, 4, 6, and 8 are correctly classified. When the true label is 7, 97% of the data is correctly classified, and 3% is misclassified as class 0 or 3. A high-efficiency CNN classifier is used to classify malicious code efficiently.

[0056] It should be noted that, through experimental comparison of various optimizers, the Adam optimizer with better convergence speed and accuracy was selected, and a variable learning rate was used. The initial learning rate was set to 0.005, and after every 5 epochs, the learning rate was reduced to 0.9 times the original value, so as to achieve the goal of gradually approaching the optimal value of the classification result.

[0057] In one optional implementation of this embodiment, after the step of classifying the feature map using the trained convolutional neural network, the method further includes: evaluating the model performance of the convolutional neural network using accuracy, precision, recall, and the weight ratio of precision to recall.

[0058] Specifically, in this embodiment, the formula for calculating accuracy is:

[0059]

[0060] The formula for calculating accuracy is:

[0061]

[0062] The formula for calculating recall rate is:

[0063]

[0064] The formula for calculating the weighted ratio of precision to recall is:

[0065]

[0066] S represents the number of samples in the dataset, i represents the i-th sample in S, y represents the predicted value, Y represents the true value, and l(Y) i =y i Let P(y) be an indicator function, s be a subset of S, and P(y) be a subset of S. s ,Y s R(y) represents the proportion of truly positive samples among those predicted to be positive. s ,Y s F1 represents the percentage of positive samples that are correctly predicted. Accuracy reflects the proportion of samples correctly classified by the model to the total number of samples. Precision reflects the model's ability not to label a negative sample as a positive sample. Recall reflects the model's ability to find all positive samples. F1 is a weighted average of the two.

[0067] It should be noted that, according to the experimental results, the final accuracy was 99.26%, precision was 99.10%, recall was 99.31%, and the weighted ratio of precision to recall was 99.19%. Through the improved feature weight calculation method, the ASM file achieved an accuracy in the big2015 dataset that is much higher than the accuracy obtained by other feature weight algorithms in the existing technology.

[0068] Based on the embodiments of the above application, candidate words are extracted from the training set according to all malware categories; feature weights are calculated for all candidate words, and a feature word library is selected based on the feature weights; features are extracted from all ASM files using the feature word library to obtain feature maps of the ASM files; and the feature maps are classified using a trained convolutional neural network. By implementing the scheme of this application, by calculating the feature weights of malware candidate words, extracting features from the ASM files of malware based on the feature weights, and finally classifying malware using a convolutional neural network, the accuracy of feature extraction is improved while achieving efficient classification of malware.

[0069] Figure 3 The method described in the second embodiment of this application is a refined malware classification method, which includes:

[0070] Step 301: Randomly divide the labeled data samples on the dataset into training set and test set according to malware category.

[0071] Specifically, in this embodiment, the dataset is the Big2015 dataset released by Microsoft on the Kaggle platform in 2015. This dataset has become a benchmark dataset for malware researchers and is widely cited. Each sample in the dataset contains two types of files: an ASM file generated by disassembling with the IDA tool and a byte file represented in hexadecimal.

[0072] Step 302: Extract candidate words based on all malware categories on the training set.

[0073] Step 303: Calculate the feature weights of all candidate words based on the improved feature weight algorithm, and select the feature word library according to the feature weights.

[0074] Specifically, in this embodiment, 1-gram candidate words in each of the malware categories are counted on the training set, where 1-gram is the case of N-gram when the sliding window N is 1; an analysis is performed on a candidate word a; the probability PA of the candidate word a appearing in the dataset is calculated; the probability PB of the candidate word a appearing in a category C is calculated; and the feature weight of the candidate word a is calculated based on the PA and the PB.

[0075] Step 304: Extract features from all ASM files using the feature vocabulary to obtain the maximum and minimum values ​​of the feature vectors corresponding to the feature vocabulary.

[0076] Step 305: Standardize the maximum and minimum values ​​of the feature vectors based on the input data of the convolutional neural network and the image visualization data.

[0077] Step 306: Convert the standardized feature vectors into feature maps of the ASM file.

[0078] Step 307: Classify the feature maps using the trained convolutional neural network.

[0079] According to the malware classification method provided in this application, the labeled data samples on the dataset are randomly divided into training and test sets according to malware categories. Candidate words are extracted from the training set based on all malware categories. Feature weights of all candidate words are calculated using an improved feature weight algorithm, and a feature word library is selected based on these weights. Features are extracted from all ASM files using the feature word library to obtain the maximum and minimum values ​​of the feature vectors corresponding to the feature word library. The maximum and minimum values ​​of the feature vectors are standardized according to the input data requirements of the convolutional neural network and the image visualization data requirements. The standardized feature vectors are transformed into feature maps of the ASM files. The trained convolutional neural network is then used to classify the feature maps. By calculating the feature weights of malware candidate words and extracting features from the ASM files of malware based on these weights, the malware is finally classified using a convolutional neural network. This improves the accuracy of feature extraction while achieving efficient malware classification.

[0080] Figure 4A malware classification device is provided in the third embodiment of this application. This malware classification device can be used to implement the malware classification method in the foregoing embodiments. Figure 4 As shown, this malware classification device mainly includes:

[0081] Extraction module 401 is used to extract candidate words based on all malware categories on the training set;

[0082] The calculation module 402 is used to calculate the feature weights of all candidate words and select the feature word library based on the feature weights;

[0083] The acquisition module 403 is used to extract features from all ASM files using a feature dictionary and obtain the feature maps of the ASM files.

[0084] The classification module 404 is used to classify the feature maps using the trained convolutional neural network.

[0085] In an optional implementation of this embodiment, the extraction module is further configured to: extract labeled data samples from the dataset; wherein the dataset is the big2015 dataset. The classification module is further configured to: randomly divide the labeled data samples into training and test sets according to malware categories.

[0086] Furthermore, in an optional implementation of this embodiment, the calculation module is specifically used for: counting 1-gram candidate words in each malware category on the training set; where 1-gram is the case of N-gram when the sliding window N is 1, and N-gram is a language model for continuous speech recognition of words in natural language processing; analyzing a candidate word a, calculating the probability PA of candidate word a appearing in the dataset, the calculation formula is expressed as:

[0087]

[0088] Where, N a N represents the number of times candidate word 'a' appears in the dataset. D Let be the number of samples in the dataset; calculate the probability PB of candidate word 'a' appearing in a category C, expressed by the formula:

[0089]

[0090] Among them, C a Let N be the number of times 'a' appears in category C. C Let PA be the number of samples in category C; calculate the feature weights of candidate word a based on PA and PB, using the following formula:

[0091]

[0092] Where Weight(a) is the feature weight of candidate word a.

[0093] In an optional implementation of this embodiment, when the calculation module performs the function of selecting a feature word library based on feature weights, it is specifically used to: merge the feature weights of all malware categories and then deduplicate all feature weights; sort the remaining feature weights after deduplication of candidate words in descending order; and select the top N candidate words as the feature word library.

[0094] In one optional implementation of this embodiment, the acquisition module is specifically used to: extract features from all ASM files using a feature vocabulary to obtain the maximum and minimum values ​​of the feature vectors; standardize the maximum and minimum values ​​of the feature vectors according to the input requirements of the convolutional neural network and the image visualization requirements; and convert the standardized feature vectors into grayscale images; wherein the grayscale image is the feature map of the ASM file.

[0095] Furthermore, in an optional implementation of this embodiment, the classification module is specifically used for: dividing the trained convolutional neural network into convolutional layers, activation layers, pooling layers, and fully connected layers using a CNN classifier; classifying the feature map using convolutional layers, activation layers, and pooling layers; and after classifying the feature map using the trained convolutional neural network, further including: outputting the classification result of the feature map through a fully connected layer.

[0096] Furthermore, in an optional embodiment of this invention, the malware classification device further includes an evaluation module. The evaluation module is used to evaluate the model performance of the convolutional neural network using accuracy, precision, recall, and a weighted ratio of precision to recall; wherein the formula for calculating accuracy is:

[0097]

[0098] The formula for calculating accuracy is:

[0099]

[0100] The formula for calculating recall rate is:

[0101]

[0102] The formula for calculating the weighted ratio of precision to recall is:

[0103]

[0104] S represents the number of samples in the dataset, i represents the i-th sample in S, y represents the predicted value, Y represents the true value, and l(Y) i =y iLet P(y) be an indicator function, s be a subset of S, and P(y) be a subset of S. s ,Y s R(y) represents the proportion of truly positive samples among those predicted to be positive. s ,Y s ) represents the percentage of positive samples that were correctly predicted.

[0105] According to the malware classification device provided in this application, candidate words are extracted from the training set based on all malware categories; feature weights are calculated for all candidate words, and a feature word library is selected based on the feature weights; features are extracted from all ASM files using the feature word library to obtain feature maps of the ASM files; and the feature maps are classified using a trained convolutional neural network. By implementing this application, by calculating the feature weights of malware candidate words, extracting features from ASM files of malware based on the feature weights, and finally classifying malware using a convolutional neural network, the accuracy of feature extraction is improved while achieving efficient malware classification.

[0106] Figure 5 An electronic device is provided as a fourth embodiment of this application. This electronic device can be used to implement the malware classification method in the foregoing embodiments, and mainly includes:

[0107] The system includes a memory 501, a processor 502, and a computer program 503 stored on the memory 501 and executable on the processor 502. The memory 501 and the processor 502 are communicatively connected. When the processor 502 executes the computer program 503, it implements the malware classification method described in the foregoing embodiments. The number of processors can be one or more.

[0108] The memory 501 can be a high-speed random access memory (RAM) or a non-volatile memory, such as a disk storage device. The memory 501 is used to store executable program code, and the processor 502 is coupled to the memory 501.

[0109] Furthermore, embodiments of this application also provide a computer-readable storage medium, which may be disposed in the electronic device described in the above embodiments, and the computer-readable storage medium may be as described above. Figure 5 The memory in the illustrated embodiment.

[0110] The computer-readable storage medium stores a computer program that, when executed by a processor, implements the malware classification method described in the foregoing embodiments. Furthermore, the computer-readable storage medium can also be a USB flash drive, external hard drive, read-only memory (ROM), RAM, magnetic disk, or optical disk, or any other medium capable of storing program code.

[0111] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0112] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0113] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0114] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned readable storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0115] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0116] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0117] The above is a description of the malware classification method, apparatus, device, and readable storage medium provided in this application. For those skilled in the art, based on the ideas of the embodiments of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for classifying malware, characterized in that, include: Extract labeled data samples from the dataset; wherein, the dataset is the big2015 dataset; The labeled data samples are randomly divided into training and test sets according to malware categories; Candidate words are extracted from the training set based on all malware categories; Calculate the feature weights of all the candidate words, and select a feature word library based on the feature weights; Feature extraction is performed on all ASM files using the aforementioned feature vocabulary to obtain feature maps of the ASM files; The feature maps are classified using a trained convolutional neural network; The step of calculating the feature weights of all the candidate words includes: On the training set, count the 1-gram candidate words in each of the aforementioned malware categories; wherein, the 1-gram is the case of N-gram when the sliding window N is 1, and the N-gram is a language model for continuous speech recognition of words in natural language processing; For a candidate word 'a', the probability PA of 'a' appearing in the dataset is calculated using the following formula: Wherein, the N a N is the number of times the candidate word 'a' appears in the dataset. D The number of samples in the dataset; The probability PB of the candidate word a appearing in a category C is calculated using the following formula: Among them, C a N is the number of times 'a' appears in category C. C The number of samples in category C; The feature weight of candidate word a is calculated based on PA and PB, and the calculation formula is expressed as follows: Wherein, Weight(a) is the feature weight of the candidate word a.

2. The malware classification method according to claim 1, characterized in that, The step of selecting the feature vocabulary based on the feature weights includes: After merging the feature weights of all the aforementioned malware categories, the feature weights are deduplicated. The remaining feature weights after deduplication of the candidate words are sorted in descending order; Select the top N candidate words as the feature word library.

3. The malware classification method according to claim 1, characterized in that, The step of extracting features from all ASM files using the feature vocabulary to obtain feature maps of the ASM files includes: Feature extraction is performed on all ASM files using the aforementioned feature vocabulary to obtain the maximum and minimum values ​​of the feature vectors; Based on the input requirements of the convolutional neural network and the image visualization requirements, the maximum and minimum values ​​of the feature vector are standardized. The standardized feature vector is converted into a grayscale image; wherein, the grayscale image is the feature map of the ASM file.

4. The malware classification method according to claim 3, characterized in that, The step of classifying the feature map using the trained convolutional neural network includes: The trained convolutional neural network is divided into convolutional layers, activation layers, pooling layers, and fully connected layers using a CNN classifier. The feature map is classified using the convolutional layer, the activation layer, and the pooling layer. After the step of classifying the feature map using the trained convolutional neural network, the method further includes: The classification result of the feature map is output through the fully connected layer.

5. The malware classification method according to claim 4, characterized in that, After the step of classifying the feature map using the trained convolutional neural network, the method further includes: The performance of the convolutional neural network model is evaluated using accuracy, precision, recall, and a weighted ratio of precision to recall; wherein, the formula for calculating accuracy is: The formula for calculating the accuracy is: The formula for calculating the recall rate is: The formula for calculating the weighted ratio of precision to recall is as follows: S represents the number of samples in the dataset, i represents the i-th sample in S, y represents the predicted value, Y represents the true value, and l(Y) represents the predicted value. i =y i ) represents an indicator function, s represents a subset of S, and P(y) represents an indicator function. s ,Y s R(y) represents the proportion of truly positive samples among those predicted to be positive. s ,Y s ) represents the percentage of positive samples that were correctly predicted.

6. A malware classification device, characterized in that, include: An extraction module is used to extract labeled data samples from a dataset, wherein the dataset is the big2015 dataset; the labeled data samples are randomly divided into training set and test set according to malware category; candidate words are extracted from the training set based on all malware categories; The calculation module is used to calculate the feature weights of all the candidate words and select a feature word library based on the feature weights; The acquisition module is used to extract features from all ASM files using the feature vocabulary to obtain the feature maps of the ASM files; A classification module is used to classify the feature maps using a trained convolutional neural network; The calculation module is specifically used for: On the training set, count the 1-gram candidate words in each of the aforementioned malware categories; wherein, the 1-gram is the case of N-gram when the sliding window N is 1, and the N-gram is a language model for continuous speech recognition of words in natural language processing; For a candidate word 'a', the probability PA of 'a' appearing in the dataset is calculated using the following formula: Wherein, the N a N is the number of times the candidate word 'a' appears in the dataset. D The number of samples in the dataset; The probability PB of the candidate word a appearing in a category C is calculated using the following formula: Among them, C a N is the number of times 'a' appears in category C. C The number of samples in category C; The feature weight of candidate word a is calculated based on PA and PB, and the calculation formula is expressed as follows: Wherein, Weight(a) is the feature weight of the candidate word a.

7. An electronic device, characterized in that, Includes memory and processor, of which: The processor is used to execute computer programs stored in the memory; When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images