A malicious PE file detection method based on a genetic convolutional network

Abstract

The application discloses a malicious PE file detection method based on a genetic convolution network and belongs to the technical field of network security. The application solves the problem of poor classification effect of a fixed special classification model by constructing a global multi-modal and multi-task network; the most important features are extracted by constructing a local neural network structure, using the idea of a small convolution kernel and the idea of a maximum pooling layer, the training speed of the model is accelerated, and the problem that pictures with consistent sizes must be input in a traditional neural network is solved by using the idea of a pyramid pooling layer.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security, and in particular to a malicious PE file detection method based on a genetic convolutional network. BACKGROUND

[0002] The full name of a PE file is Portable Executable, which means a portable executable file. Common EXE, DLL, OCX, SYS and COM are all PE files. A PE file is a program file on a Microsoft Windows operating system.

[0003] At present, the Net Market Share tool is usually used to detect the operating system type of the existing computers in the world. According to the report of the company to which the tool belongs in September 2020, the use rate of the Windows system in computers is as high as 87.6%, and has been in the highest proportion for ten consecutive years. Subsequently, the types and quantities of malicious software data sets related to the Windows system also gradually increase. The most commonly used malicious PE software data set of the Windows system is the Malimg data set, the Microsoft BIG 2015 data set and the Malicia data set.

[0004] As is known to all, the number of families of malicious PE files is huge, and each family contains a large number of samples. The Malimg data set is composed of 9339 malicious PE files from 25 different malicious PE file families. Nataraj et al. created the Malimg data set by reading the malicious software binary code as an 8-bit unsigned integer. The matrix can be converted into a gray-scale result with any pixel value ranging from 0 to 255.

[0005] The Microsoft BIG 2015 data set is also called the MCC data set or the MCC-BIG data set. The Microsoft Malware Classification Challenge (MCC for short) is a malicious software classification challenge held by Microsoft in 2015, and the data set thereof is the MCC data set. The goal of the challenge is to classify malicious software through machine learning methods. The data set contains 9 families, a total of 10868 malicious PE information. The Microsoft BIG 2015 data set is collected and extracted by Microsoft from actual malicious software samples. These samples come from real malicious software families and contain various types of malicious PE files and variants. Each sample is provided in the form of a binary file, and no image representation is directly provided. It covers different malicious software families and variants, and has diversity and challenge. The nine families in the Microsoft BIG 2015 data set are shown in Table 1.

[0006] Table 1. Nine families in the Microsoft BIG 2015 dataset

[0007] No. Family Name Number 1 Ramnit 1541 2 Lollipop 2478 3 Kelihos_ver3 2942 4 Vundo 475 5 Simda 42 6 Tracur 751 7 Kelihos_ver1 398 8 Obfuscator.ACY 1228 9 Gatak 1013 Sum 9 10868

[0008] The Malicia dataset has 11668 malware binaries from 54 families. Malicia samples are binaries, so they must be converted into images before image-based analysis can be applied. 581 samples in the Malicia dataset are not exe files, and 1192 samples do not have a family label. These samples are excluded, so the data available in the Malicia dataset is 9895 binaries from 51 families. This includes 4 large Malicia families and 47 small Malicia families.

[0009] Methods for classifying malicious PE files are divided into traditional malicious PE classification and new malicious PE classification. Traditional malicious PE classification includes static analysis methods, dynamic analysis methods, and signature-based detection methods. New malicious PE classification includes machine learning algorithms and deep learning methods.

[0010] The static analysis method in traditional malicious PE classification uses the syntax or structural properties of a program to detect malware before program execution. Its advantages are fast detection speed and simple parameter setting. The disadvantage is that malware developers use various encryption, polymorphism, and obfuscation techniques to overcome these detection algorithms. Dynamic methods refer to executing malware in a virtual environment and analyzing its behavior to detect harmful actions during or after program execution. Although dynamic analysis of malware is a promising method, it is very complex and time-consuming. Signature-based detection is to compare signatures with a database of malicious code, which is the most commonly used detection method, but its main disadvantage is that it is not scalable and its effectiveness can be undermined as malware continues to grow.

[0011] To address the limitations of the above methods, researchers have begun to develop more complex classification methods based on machine learning techniques. These techniques use different feature extraction methods to build more intelligent malware detection models. For example, in 2016, W. Hardy scholars used an SVM-based classifier; in 2001, M. G. Schultz scholars used a Naive Bayes classifier, etc. The most recent research is the classification method based on deep learning, which has a high classification accuracy.

[0012] Convolutional Neural Network (CNN) is a deep learning model mainly used for processing data with grid structure, especially perceptual data such as images and speech. It simulates the working way of human visual system to efficiently extract and learn features from input data. It uses convolution operation to extract local features from input data and reduces the complexity of the model through shared parameters. This makes CNN efficient and scalable when processing large-scale data.

[0013] At present, the application scene of the CNN model for malicious PE file classification is limited, the network model structure is fixed, and the same network structure model is used for classification of all malicious software family data sets. The problem brought by this is that the model has high classification accuracy only for specific data sets or similar data sets, and when the data set is changed, such as adding new malicious samples, the fixed special classification model has poor classification effect and will no longer be applicable.

[0014] In addition, the traditional convolutional neural network uses the most basic convolutional network when classifying malicious software, which cannot guarantee the accuracy and speed of training, and the parameters are not easy to adjust during the training process, which may cause model underfitting or overfitting. The most important thing is that all traditional convolutional neural networks face a common problem, that is, they must ensure that the input pictures have the same size. This will lead to the need for local cropping of input pictures in order to meet the preprocessing conditions of traditional convolutional neural networks, but this will cause feature loss and misinterpretation. SUMMARY

[0015] Therefore, the purpose of the present application is to propose a malicious PE file detection method based on genetic convolutional network, which solves the problem of poor classification effect of fixed special classification model by constructing a global multi-modal and multi-task network, and extracts the most important features by constructing a local neural network structure, using the idea of small convolution kernel and the idea of maximum pooling layer, and speeding up the training speed of the model, and using the idea of pyramid pooling layer to solve the problem of inputting pictures with consistent size in traditional neural networks.

[0016] In order to achieve the above purpose, the present application provides the following technical scheme:

[0017] The present application proposes a malicious PE file detection method based on genetic convolutional network, which adopts a global multi-modal and multi-task network and the following steps for the classification task of new malicious PE files:

[0018] The picture is input into a global multi-modal and multi-task network, and after sequentially passing through a convolution layer, a pooling layer and an activation function layer, the global multi-modal and multi-task network automatically selects and calls a local unit neural network module learned from a previous task to perform malicious PE file detection;

[0019] The global multi-modal and multi-task network comprises a convolution layer, a pooling layer, an activation function layer and a plurality of local unit neural network modules; the global multi-modal and multi-task network performs parameter adjustment on the closest previous learning task found to generate a sub-learning task, which is used to train the newly added local unit neural network module;

[0020] The local unit neural network module is trained using a local network improved based on a residual structure, which uses a small convolution kernel idea and a maximum pooling layer to extract the most important high-dimensional information, and uses a pyramid pooling layer before a full connection layer.

[0021] Further, the step of automatically selecting and calling the local unit neural network module learned from the previous task by the global multi-modal and multi-task network according to the genetic algorithm comprises:

[0022] (1) adaptive function selection: based on knowledge division, the local unit neural network module learned before is divided into components that can be called by multiple tasks, and the adaptive function is defined as the accuracy rate when selecting and calling the classification malicious PE file knowledge learned from the previous task for the new module;

[0023] (2) elite selection: when selecting the local unit neural network module, the steps of first selecting in order, then selecting randomly, and finally selecting uniformly are followed;

[0024] (3) crossover operator: the crossover operator is applied to the local unit neural network module that has been trained with a local residual neural network, so that the parameters and advantageous network structures in different local unit neural network modules to be migrated are exchanged with each other at a set probability to generate new local unit neural network modules, which are automatically selected and called by the genetic algorithm for the newly added multiple local unit neural network modules;

[0025] (4) mutation operator: the whole mutation and local mutation are used to generate new local unit neural network modules, which are automatically selected and called by the genetic algorithm for the newly added multiple local unit neural network modules;

[0026] (5) training and evaluation: the selected local unit neural network module is trained on a given number of rounds of newly added malicious PE file classification tasks, and is evaluated on a validation set after each round.

[0027] Further, the order selection is performed according to the order of the classification accuracy of the malicious PE file in the previous round of iteration from high to low, and if all the local unit neural network modules of the current task are exhausted, the local unit neural network module of the previous learning task is selected, and if the previous learning task is still not selected, a random selection is performed.

[0028] Further, the random selection is performed on the local unit neural network modules of other tasks except the current task in the globally generated multiple local unit neural network modules, and the local unit neural network modules are selected one by one, and if the previous learning task is still not selected, a uniform selection is performed.

[0029] Further, the whole variation is that the existing to-be-migrated local unit neural network module is selectively called, the local unit neural network module that is not called is temporarily frozen, and the newly added malicious PE file classification task can only call the local unit neural network module that is not frozen, and the training parameters and network structure of the local unit neural network module are obtained; the frozen local unit neural network module is temporary, and is automatically unfrozen to the original state after the end of the current round of variation.

[0030] Further, the local variation is that the specific parameters of the network architecture in each trained local unit neural network module are changed, and all the selected local unit neural network modules participate in the model training of the newly added malicious PE file classification task in the local variation.

[0031] Further, the local network improved based on the residual structure includes four convolutional layers and four pooling layers, the convolution kernel size of the first three convolutional layers is 5*5, and the convolution kernel size of the last convolutional layer is 3*3; during the convolution operation, the padding amount of each operation is set to 2, and the step is set to 2; after each layer of convolution, normalization processing, activation function processing and maximum pooling processing are sequentially used.

[0032] Further, the pyramid pooling layer adopts three convolution kernels, and the sizes of the three convolution kernels are 4*4, 2*2 and 1*1.

[0033] Further, in the training process of the local unit neural network module, the data enhancement and regularization combination method is used.

[0034] Further, in the process of migrating the local unit neural network module, different learning rates are used, and different optimization functions and lossers are used in the test process, and the results caused by different parameter changes are observed.

[0035] Compared with the prior art, the beneficial effects of the present application are:

[0036] 1. The genetic convolutional network-based malicious PE file detection method provided by the present application, in view of the characteristics of a large number of malicious PE files and complex classification and the problem that the previous malicious PE file classification model is fixed and cannot be dynamically updated, a global multimodal and multi-task network based on a genetic algorithm is constructed. The global network can change the network structure according to the demand, and the network has universality. The global multimodal and multi-task network can automatically select and migrate the local unit neural network module learned from the previous task when solving a new malicious PE file classification task. The global classification neural network structure will dynamically change according to the high-dimensional features learned from the data set. With the complexity of the input data, the complexity of the network structure is automatically adjusted. For unused local network modules, the global network is temporarily frozen, thereby reducing the calculation parameters. Therefore, the global multimodal and multi-task network can automatically change the complexity of the network structure according to the data set while ensuring the training speed. Therefore, the global multimodal and multi-task network proposed in the present application can receive dynamically changing and continuously added malicious PE file classification tasks, and solves the specificity and fixity of traditional models. In today's world with huge differences in malicious software categories, the network can tailor the training network structure for each data set to ensure high accuracy of each classification task. The global multimodal and multi-task network continuously learns from an infinite task stream, and automatically selects and reuses the local network module learned from the previous task when facing a new malicious PE file classification task, thereby ensuring the training accuracy while reducing the parameter quantity.

[0037] 2. The genetic convolutional network-based malicious PE file detection method provided by the present application, in view of the problem of slow training speed and low accuracy of the malicious PE file classification task, a local neural network structure is constructed, which is improved based on a residual network. The local neural network structure uses the idea of small convolution kernel and the idea of maximum pooling layer to extract the most important features and speed up the training of the model; uses a residual structure to avoid the phenomenon of overfitting and difficulty in adjusting parameters in the training process of a traditional neural network; uses the idea of pyramid pooling layer to ensure that different sizes of malicious PE files can be accepted by the local network, solves the problem that the size of the input picture must be consistent in the traditional neural network, and avoids the occurrence of feature loss and feature misjudgment caused by cropping. In the training process, the data enhancement and regularization module are combined, and different learning rates, optimization functions and loss functions are used for testing. From the training configuration point of view, the training process of the local network is adjusted, solving the problems of poor model migration effect, decreased classification accuracy after migration to a new model, gradient disappearance and forgetting in the malicious PE file classification task; at the same time, the high-speed and high-accuracy local network provided by the present application also provides a prerequisite for migration to the global multimodal and multi-task network. BRIEF DESCRIPTION OF DRAWINGS

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0039] Figure 1 This is a diagram of the global multimodal, multitasking network architecture provided by the present invention.

[0040] Figure 2 A flowchart for global network invocation of local modules provided by the present invention.

[0041] Figure 3 This is a schematic diagram of a local network structure provided by the present invention. Detailed Implementation

[0042] To better understand this technical solution, the method of the present invention will be described in detail below with reference to the accompanying drawings.

[0043] This invention proposes a malicious PE file detection method based on genetic convolutional networks, constructing a globally multimodal, multi-task-intensive network, such as... Figure 1 As shown, the global multimodal, multi-task network includes convolutional layers, pooling layers, activation function layers, and several local unit neural network modules. During the malicious PE file classification process, various local unit network modules are combined to form a global training network.

[0044] For the novel malicious PE file classification task, a global multimodal, multi-task network and the following steps are employed: Images are input into the global multimodal, multi-task network, passing through convolutional layers, pooling layers, and activation function layers sequentially. The global multimodal, multi-task network then automatically selects and calls local unit neural network modules learned from previous tasks for malicious PE file detection based on a genetic algorithm. The local unit neural network modules are trained using a residual structure-based improved local network, which utilizes small convolutional kernels and max pooling layers to extract the most important high-dimensional information, and uses a pyramid pooling layer before the fully connected layers. During the training of the local unit neural network modules, a combination of data augmentation and regularization is employed. During the transfer learning process of the local unit neural network modules, different learning rates are used, and different optimization functions and loss mechanisms are used during testing to observe the results caused by different parameter changes, thereby ensuring good transfer performance.

[0045] The following section provides a detailed explanation of the global multimodal, multitasking network, and local unit neural network modules.

[0046] 1. A global multimodal, multi-task network

[0047] The global multimodal, multi-task network can allow the system to automatically dynamically expand its structural composition model, and automatically select and migrate the unit neural network modules learned by previous tasks when solving new malicious PE file classification tasks. New tasks in the global multimodal, multi-task network can be dynamically and continuously added, and the number of newly added parameters for each task can be reduced. The generated multi-task model is sparsely activated, and integrates a task-based routing that can guarantee limited computing cost. The global multimodal, multi-task network adjusts the parameters of the closest previously learned task found to generate a sub-learning task, which is used to train the newly dynamically added local unit neural network module. The exploration of the task path space and the identification of the most relevant prior knowledge subset for each task are guided by a genetic algorithm, which is designed to dynamically adjust the exploration without manual operation.

[0048] Specifically, the process of automatically selecting and calling the local unit neural network module learned by the previous task according to the genetic algorithm of the global multimodal, multi-task network is as shown in Figure 2 The steps include:

[0049] (1) Initialization (adaptive function selection): Based on knowledge division, the previously learned local unit neural network modules are divided into components that can be called by multiple tasks, and the adaptive function is defined as the accuracy rate when selecting and calling the previously learned classification malicious PE file knowledge for new modules.

[0050] (2) Elite selection: When selecting a local unit neural network module, follow the steps of first sequential selection, then random selection, and finally uniform selection.

[0051] Sequential selection refers to selecting local unit neural network modules in the order of the accuracy rate of malicious PE file classification from high to low in the last round of iteration. If all local unit neural network modules for the current task have been exhausted and no local unit neural network module from the previously learned task is selected, random selection is used.

[0052] Random selection refers to randomly arranging and selecting one by one the local unit neural network modules of other tasks except the current task among the multiple local unit neural network modules generated globally. If no previously learned task is selected, uniform selection is used.

[0053] Uniform selection refers to uniformly and randomly selecting all local unit neural network modules for malicious PE file classification.

[0054] (3) Cross operator: The cross operator is applied to the local unit neural network module that has been trained with the local residual neural network. The parameters and superior network structure in different local unit neural network modules to be migrated are exchanged with a set probability to generate new local unit neural network modules for the newly added multiple local unit neural network modules to automatically select and call through the genetic algorithm.

[0055] (4) Mutation operator: The new local unit neural network module is generated by using the whole mutation and local mutation, and the newly added multiple local unit neural network modules are automatically selected and called through the genetic algorithm.

[0056] The whole mutation, that is, the selective calling of the existing local unit neural network module to be migrated, the un-called local unit neural network module is temporarily frozen; the newly added large-scale malicious PE file classification task can only call the unfrozen local unit neural network module and obtain the training parameters and network structure of the local unit neural network module; the frozen local unit neural network module is temporary, and is automatically unfrozen to the original state after the end of this round of mutation.

[0057] The local mutation, that is, the slight change of the specific parameters of the network architecture in each trained local unit neural network module, in the local mutation, all selected local unit neural network modules participate in the model training of the newly added large-scale malicious PE file classification task.

[0058] (5) Training and evaluation: The selected local unit neural network module is trained on the newly added large-scale malicious PE file classification task for a given number of rounds, and is evaluated on the validation set after each round.

[0059] 2. Local unit neural network module

[0060] The scheme proposes a local network structure for extracting high-dimensional features of each part of the data set. The network structure mainly improves the residual network. The local network structure uses the small convolution kernel idea and extracts the most important high-dimensional information through the maximum pooling layer to speed up the training speed. In addition, the local network uses a pyramid pooling layer before the fully connected layer, so the local network can receive images of various sizes as input. The improved local network structure is as shown in Figure 3 .

[0061] The improved local network based on residual structure is composed of four convolutional layers and four pooling layers. Taking an input of 64*64 as an example, the convolution kernel size of the first three convolutional layers is 5*5, and the convolution kernel size of the last convolutional layer is 3*3. During the convolution operation, the padding of each operation is set to 2, and the stride is set to 2. The advantage of using a small convolution kernel is to reduce the amount of operation parameters and speed up the training speed while ensuring the extraction of feature details. After each convolutional layer, normalization (Batch Norm) processing, activation function (Relu) processing and maximum pooling (Max Pooling) processing are used. The batch normalization layer can standardize the discrete data to a certain range, facilitate the nonlinear change of the activation function, and thus prevent the gradient dispersion or gradient explosion phenomenon in the model training process. By using the activation function, a nonlinear change can be added to the local network to better describe the high-dimensional picture features of the PE file. Here, the Relu activation function is used, which is simple but effective. The Relu function outputs nothing for negative values and a linearly increasing output for positive values. Through maximum pooling, the most obvious high-dimensional features can be focused on. Here, the maximum pooling size is set to 5*5, which improves the calculation speed. In terms of channel number, the first convolutional layer has an input of 1-channel picture and an output of 64-channel data. The input of the second convolutional layer is 64-channel data, and the output is 256-channel data. Similarly, the output of the last layer is 192-channel data. When passing the data into the fully connected layer, the number of fully connected layers can be selected according to the required picture accuracy and the residual network.

[0062] For input of malicious software pictures of different sizes, the local network structure uses pyramid pooling between the last convolutional layer and the fully connected layer to ensure that the input malicious software can be accepted. The pyramid pooling layer uses three convolution kernels with sizes of 4*4, 2*2 and 1*1. These three convolution kernels extract different accuracy features of the input malicious software, and then merge them into fixed (16+4+1) dimensions to ensure that the dimensions of the malicious software are consistent when sent to the fully connected layer.

[0063] The high speed and high accuracy of the local network structure training lay a foundation for migrating to a global multi-modal and multi-task network. However, during the migration of the local network, there are problems such as gradient disappearance, classification accuracy decline and forgetting. Therefore, this scheme also proposes a strategy for training the local network, which combines data augmentation and regularization modules during training, and tests different learning rates, optimization functions and loss functions to observe the results caused by different parameter changes. Thus, the performance of the local network is fully utilized.

[0064] The above examples are only used to illustrate the technical solutions of the present application, but not to limit the present application; although the present application has been described in detail with reference to the foregoing examples, those ordinarily skilled in the art should understand: the technical solutions recorded in the foregoing examples can still be modified, or some technical features can be replaced equivalently, but these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting malicious PE files based on a genetic convolutional network, characterized in that, For the new malicious PE file classification task, a global multi-modal, multi-task network and the following steps are used: The picture is input into the global multi-modal, multi-task network, which sequentially passes through the convolution layer, the pooling layer and the activation function layer, and then the global multi-modal, multi-task network automatically selects and calls the local unit neural network module learned from the previous task for malicious PE file detection according to the genetic algorithm. The global multi-modal, multi-task network includes a convolution layer, a pooling layer, an activation function layer and a plurality of local unit neural network modules; the global multi-modal, multi-task network adjusts the parameters of the closest previous learning task found to generate a sub-learning task for training the newly added local unit neural network module; The local unit neural network module is trained using a local network improved based on a residual structure, which uses a small convolution kernel and a maximum pooling layer to extract the most important high-dimensional information, and uses a pyramid pooling layer before the full connection layer; The step of automatically selecting and calling the local unit neural network module learned from the previous task by the global multi-modal, multi-task network includes: (1) Adaptive function selection: based on knowledge division, the previously learned local unit neural network module is divided into components that can be called by multiple tasks, and the adaptive function is defined as the accuracy of selecting and calling the previously learned classification malicious PE file knowledge for the new module; (2) Elite selection: when selecting a local unit neural network module, follow the steps of first sequential selection, then random selection, and finally uniform selection; (3) Cross operator: apply the cross operator to the local unit neural network module trained with the local residual neural network to let the parameters and advantage network structures in different local unit neural network modules to be migrated exchange with each other at a set probability to generate new local unit neural network modules for the newly added multiple local unit neural network modules to be automatically selected and called by the genetic algorithm; (4) Mutation operator: adopt both global mutation and local mutation to generate new local unit neural network modules for the newly added multiple local unit neural network modules to be automatically selected and called by the genetic algorithm; (5) Training evaluation: sample the selected local unit neural network module to train on the given number of rounds of newly added malicious PE file classification tasks, and evaluate on the validation set after each round; The sequential selection selects the local unit neural network module in the order of the malicious PE file classification accuracy from high to low in the last iteration, and if all the local unit neural network modules of the current task are exhausted, random selection is used; The random selection randomly arranges and selects the local unit neural network modules of other tasks except the current task among the multiple local unit neural network modules generated globally, and if the local unit neural network module of the previous learning task is still not selected, uniform selection is used; The uniform selection selects the local unit neural network modules of the previous learning task from the multiple local unit neural network modules generated globally. The integral variation is that the existing local unit neural network module to be migrated is selectively called, and the un-called local unit neural network module is temporarily frozen; the newly added malicious PE file classification task can only call the unfrozen local unit neural network module and obtain the training parameters and network structure of the local unit neural network module; the frozen local unit neural network module is temporary, and is automatically unfrozen to the original state after the end of the current round of variation; The local variation is that the specific parameters of the network architecture in each trained local unit neural network module are changed, and all the selected local unit neural network modules participate in the model training of the newly added malicious PE file classification task in the local variation.

2. The method according to claim 1, wherein, The local network improved based on the residual structure includes four convolutional layers and four pooling layers, the convolution kernel size of the first three convolutional layers is 5*5, and the convolution kernel size of the last convolutional layer is 3*3; during the convolution operation, the padding amount of each operation is set to 2, and the stride is set to 2; after each layer of convolution, normalization processing, activation function processing and maximum pooling processing are used in sequence. 3.The genetic convolution network-based malicious PE file detection method of claim 1, wherein, The pyramid pooling layer adopts three convolution kernels, and the sizes of the three convolution kernels are 4*4, 2*2 and 1*1 respectively.

4. The method according to claim 1, wherein, In the training process of the local unit neural network module, the data enhancement and regularization combination method is adopted.

5. The method according to claim 1, wherein, In the migration process of the local unit neural network module, different learning rates are used, and different optimization functions and lossers are used in the test process, and the results caused by different parameter changes are observed.

Images