A Malware Classification Method Based on Bidirectional Temporal Convolutional Networks and Feature Fusion
By employing a bidirectional temporal convolutional network and feature fusion, the problem that a single TCN cannot learn the associated features of malicious code is solved, achieving high-precision classification of malicious code and improving detection performance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-15
- Publication Date
- 2026-03-13
AI Technical Summary
Existing technologies using a single temporal convolutional network (TCN) cannot effectively learn the relationship between the current feature and subsequent features, resulting in insufficient accuracy in malicious code classification and identification.
A method based on bidirectional temporal convolutional networks and feature fusion is adopted. By preprocessing the original malicious code file, grayscale image texture features and opcode sequence features are extracted and fused. The bidirectional temporal convolutional network is then used for training and classification.
It improves the accuracy of malicious code detection, makes full use of previous and subsequent data information, enhances the model's learning ability, and achieves higher classification accuracy and recognition effect.
Smart Images
Figure CN117113163B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of malicious code classification, specifically a malicious code classification method based on bidirectional temporal convolutional networks and feature fusion. Background Technology
[0002] Malicious code is a type of code or web script that is harmful to a computer system. Its purpose is to create system vulnerabilities in a target computer, enabling the theft of data and information, and posing a potential threat to the system and files. Malicious code analysis techniques are categorized into dynamic analysis and static analysis techniques based on whether the executable file is run. Dynamic analysis refers to the practice of running executable files in sandboxes, emulators, and virtual machines and monitoring and analyzing application behavior through system calls. Static analysis methods extract static features of malicious code to identify the illegal behavior of samples and can capture information related to structural characteristics, such as API calls and opcodes.
[0003] Temporal convolutional networks (TCNs) are a new member of the convolutional neural network (CNN) family. They employ dilated convolutions to expand the model's receptive field and reduce computational cost. The causal convolution ensures the temporal order of the data, while residual connections effectively mitigate the vanishing and exploding gradient problems. Therefore, TCNs can not only process data in massive parallelism but also avoid the influence of future data on past data. TCNs mainly consist of causal convolutions, dilated convolutions, and residual connections. The convolutional networks in TCNs have parallel computation capabilities, effectively solving the problem of excessively long processing times. However, a single TCN cannot encode information from back to front, thus failing to learn the relationship between current features and subsequent features.
[0004] To uncover the bidirectional feature information contained in malicious code sequences and leverage the advantages of TCN in processing temporal feature information, inspired by bidirectional recurrent neural networks, this application proposes a malicious code classification method based on bidirectional temporal convolutional networks and feature fusion. Summary of the Invention
[0005] To address the aforementioned technical problems, this invention provides a malicious code classification method based on bidirectional temporal convolutional networks and feature fusion. This method solves the problem that existing technologies, where a single TCN cannot encode information from back to front, thus failing to learn the relationship between the current feature and subsequent feature items.
[0006] A malware classification method based on bidirectional temporal convolutional networks and feature fusion includes the following steps:
[0007] Step 11: Obtain the original malicious code file;
[0008] Step 12: Preprocess the original malicious code file to obtain a malicious code image, which makes the model more comprehensive in extracting features of malicious code, thereby further improving the accuracy of malicious code classification and recognition.
[0009] Step 13: Input the preprocessed malicious code image into a bidirectional temporal convolutional network for training. The bidirectional temporal convolutional network processes the malicious code image into data of uniform size.
[0010] Step 14: Fuse the bidirectional features of uniform size through the bidirectional temporal convolutional network to obtain the data dependency between the two propagation directions;
[0011] Step 15: Further feature extraction and compression of the feature map after the bidirectional temporal convolution;
[0012] Step 16: Obtain the classification results of malicious code.
[0013] Preferably, the data preprocessing method in step 12 includes:
[0014] S121, perform batch disassembly on the PE file of the original malicious code file to obtain .asm file and .bytes file;
[0015] S122, extract N-Gram opcode sequence features based on the .bytes file, and extract grayscale image texture features based on the .asm file;
[0016] S123, the N-Gram opcode sequence features and the grayscale image texture features are fused to obtain a malicious code image.
[0017] Preferably, the malicious code images pre-classified in step 12 are divided into a training set and a validation set. The training set is used to train the model and generate training feature vectors, while the validation set is used to observe and evaluate the performance of the model and generate validation feature vectors.
[0018] Preferably, the training set accounts for 70% and the validation set accounts for 30%.
[0019] Preferably, the method for training the bidirectional temporal convolutional network in step 13 is as follows:
[0020] Step 131: Perform convolution calculation on the sequence from left to right to achieve forward feature extraction;
[0021] Step 132: Perform convolution calculation on the sequence from right to left to achieve backward feature extraction.
[0022] Preferably, the fusion method in step 14 is pooling fusion: the fusion pooling layer obtained by paralleling max pooling and mean pooling is used to extract deep features and further capture the dependencies within the data.
[0023] Preferably, the formula for pooling fusion is as follows:
[0024] Where h is the output of the bidirectional temporal convolutional network, h max It is the output of the max pooling layer, h ave It is the output of the average pooling layer, h fuse This is the output result after fusion pooling.
[0025] Compared with the prior art, the present invention has the following beneficial effects:
[0026] 1. This invention extracts grayscale image texture features from .asm files. Using one-dimensional images instead of two-dimensional images to represent malicious code features avoids the lack of local correlations between pixels in malicious code image features caused by image folding. Grayscale image features and opcode features reflect the similarity of malicious code of the same category globally and locally, respectively, enabling the fusion of global and local features and utilizing the feature information of malicious code from multiple perspectives. Using the fused features as input to a bidirectional temporal convolutional network model for training and classification can increase the accuracy of malicious code detection and enable the temporal convolutional network to make full use of data information in both directions.
[0027] 2. This invention combines two different features using a pooling fusion method, allowing them to complement each other and fully learn the features. This results in better preservation of malicious code features, effectively improving the model's ability to learn features and achieving good classification results. Attached Figure Description
[0028] Figure 1 This is a schematic diagram of the malicious code classification method of the present invention;
[0029] Figure 2 This is a schematic diagram of the data preprocessing method of the present invention;
[0030] Figure 3 A schematic diagram of the method for training the bidirectional temporal convolutional network of the present invention;
[0031] Figure 4 This is a diagram illustrating the process of generating a grayscale image from malicious code byte features as described in this invention.
[0032] Figure 5 This is a diagram of the malicious code classification model based on BiTCN-DLP of the present invention;
[0033] Figure 6 This is a graph showing the performance of the training set and test set as a function of training batches during the model training process of this invention.
[0034] Figure 7 This is a graph showing the change in the loss rate of the present invention with the number of training batches.
[0035] Figure 8 This diagram illustrates the impact of the value of n on the model's performance in this invention.
[0036] Figure 9 A comparison diagram of the opcode sequence features, grayscale image features, and mixed features of the present invention;
[0037] Figure 10 Figure 1 shows the ablation experiment results of the BiTCN, forward TCN and reverse TCN of the present invention;
[0038] Figure 11 Feature maps are extracted using four different methods of the present invention: pooling-free pooling, mean pooling, max pooling, and fusion pooling.
[0039] Figure 12 This is a comparison chart of the model of this invention with other malware classifications in recent years. Detailed Implementation
[0040] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and should not be construed as limiting the scope of the invention.
[0041] Example 1: As shown in the attached document Figure 1 To be continued Figure 12 As shown: This invention provides a malicious code classification method based on bidirectional temporal convolutional networks and feature fusion, including the following steps:
[0042] Step 11: Obtain the original malicious code file;
[0043] Step 12: Preprocess the original malicious code file to obtain a malicious code image, which makes the model more comprehensive in extracting features of malicious code, thereby further improving the accuracy of malicious code classification and recognition.
[0044] Malicious code itself is a file composed of a series of bytes. Based on the similarity between the value range of bytes and the value range of pixels in a grayscale image, this application converts the binary file of malicious code into a grayscale image. Based on the texture similarity of grayscale images of malicious code of the same family, and the different textures caused by the different structures of malicious code of different families, the malicious code family is classified.
[0045] Figure 4It is the process of extracting malicious code byte features to generate a grayscale image. By converting the malicious code file into a binary stream, an 8-bit binary vector is read from the binary data. Each vector corresponds to a pixel. Then, the binary value of the vector is converted into a decimal value, corresponding to the range [0, 255], where 0 is black and 255 is white. This process converts the malicious code into a grayscale image.
[0046] Step 13: Input the preprocessed malicious code image into a bidirectional temporal convolutional network for training. The bidirectional temporal convolutional network processes the malicious code image into data of uniform size.
[0047] Step 14: Fuse the bidirectional features of uniform size through the bidirectional temporal convolutional network to obtain the data dependency between the two propagation directions;
[0048] Step 15: Further feature extraction and compression of the feature map after the bidirectional temporal convolution;
[0049] Step 16: Obtain the classification results of malicious code by classifying it using a softmax layer.
[0050] The data preprocessing method in step 12 includes:
[0051] S121, perform batch disassembly on the PE file of the original malicious code file to obtain .asm file and .bytes file;
[0052] S122, extract N-Gram opcode sequence features based on the .bytes file, and extract grayscale image texture features based on the .asm file;
[0053] S123, the N-Gram opcode sequence features and the grayscale image texture features are fused to obtain a malicious code image.
[0054] The malicious code images pre-classified in step 12 are divided into a training set and a validation set. The training set is used to train the model and generate training feature vectors. The validation set is used to observe and evaluate the performance of the model and generate validation feature vectors.
[0055] The training set comprises 70%, and the validation set comprises 30%.
[0056] The method for training the bidirectional temporal convolutional network in step 13 is as follows:
[0057] Step 131: Perform convolution calculation on the sequence from left to right to achieve forward feature extraction;
[0058] Step 132: Perform convolution calculation on the sequence from right to left to achieve backward feature extraction.
[0059] The fusion method in step 14 is pooling fusion: the fusion pooling layer obtained by paralleling max pooling and mean pooling is used to extract deep features and further capture the dependencies within the data.
[0060] The formula for pooling fusion is:
[0061] Where h is the output of the bidirectional temporal convolutional network, h max It is the output of the max pooling layer, h ave It is the output of the average pooling layer, h fuse This is the output result after fusion pooling.
[0062] Depend on Figure 5 As can be seen, this application extracts grayscale image texture features through .asm files, and uses one-dimensional images instead of two-dimensional images to represent malicious code features, avoiding the local correlation between pixels in the malicious code image features that does not exist due to image folding. Grayscale image features and opcode features reflect the similarity of malicious code of the same category globally and locally, respectively, enabling the fusion of global and local features and utilizing the feature information of malicious code from multiple perspectives. Using the fused features as input to a bidirectional temporal convolutional network model for training and classification can increase the accuracy of malicious code detection, enabling the temporal convolutional network to make full use of data information in both directions.
[0063] To verify the performance of the above method, this application used the training dataset from the publicly available dataset of the Malware Classification Challenge (BIG 2015) to estimate the performance of the model. This dataset contains 10,868 labeled malware samples, divided into 9 malware families. Each malware sample has been unpacked and contains two files: a .bytes file in hexadecimal representation and a .asm file obtained by disassembling the malware binary file. Each malware file has an ID, a 20-character hash value that uniquely identifies the file, and a Class.
[0064] The dataset consists of 200GB of data, including 50GB of .byte files and 150GB of .asm files. This paper divides the dataset into two parts: a training set and a validation set. The training set is used for model training, while the validation set is used to observe and evaluate the model's performance. In the experiments, 70% of the dataset was allocated to the training set and 30% to the validation set. The training set contained 7608 samples, and the validation set contained 3260 samples.
[0065] This paper uses four metrics—accuracy, precision, recall, and F1 score—to evaluate the model's performance. These metrics have been widely used in related research, and their formulas are as follows:
[0066]
[0067]
[0068]
[0069]
[0070] In this context, TP indicates that the actual malicious code sample was correctly predicted as malicious code, while FP indicates that the actual normal code sample was incorrectly predicted as malicious code. Similarly, TN indicates that the actual normal code sample was correctly predicted as normal code, while FP indicates that the actual malicious code sample was incorrectly predicted as normal code.
[0071] To fully verify the effectiveness of the proposed BiTCN-DLP-based malware classification method, the following experiment is conducted:
[0072] Experiment 1: BiTCN-DLP Performance Analysis Experiment
[0073] The selection of hyperparameters has a crucial impact on the training effect of the model. To maximize the model's performance, hyperparameter tuning is necessary. In the BiTCN-DLP model, only the opcode as a single feature is used to optimize the model parameters.
[0074] The number of convolutional kernels was selected as a hyperparameter in the optimization parameters, and the number of BiTCN layers and the number of neurons per layer were selected as variables in the model parameters.
[0075] The model iteration number was selected as 200 times. The expansion coefficient in TCN was increased by a multiple of 2. The expansion coefficient was set as (1, 2, 4, 8). The optimization algorithm was Adam
[37] and the learning rate was set to 0.002.
[0076] To avoid overfitting, a dropout layer was added with a value of 0.2. Five-fold cross-validation was used to ensure the accuracy and effectiveness of the experimental data.
[0077] Using a grid search algorithm, parameter optimization experiments were conducted for the number of convolutional kernels (2, 3, 4, 5, 6). The optimal parameter settings for the model were finally determined, as shown in the table below.
[0078]
[0079] Based on the above parameter values, the two features extracted from the opcode and bytecode are fused, and the BiTCN-DLP classification model is used for experiments.
[0080] Figure 6 This shows the performance of the training and test sets during model training as the number of training batches changes, and is a curve showing the change in accuracy as the number of training batches changes.
[0081] Figure 7 This is a curve showing the loss rate as a function of training batches. Light gray represents the test set, and dark gray represents the training set. As you can see, the model converges quickly. After training and testing, the model achieved an accuracy of 99.54% and a loss rate of 0.0292.
[0082] Experiment 2: N-gram Feature Selection Experiment
[0083] In the data processing section, this model uses the N-gram algorithm to extract features from the opcodes in malicious code, where the value of n directly affects the model's performance. To obtain the optimal value of n, with all other conditions remaining the same, the results of four different n values (2, 3, 4, and 5) were compared. The experimental results are as follows: Figure 8 As shown:
[0084] As shown in the figure, compared to other N-gram values, the model achieves an accuracy of 99.54% when n=3, which is higher than the accuracy of other values. As n increases above 3, the accuracy gradually decreases. Experimental results indicate that n=3 is the optimal value for N-grams.
[0085] Experiment 3: Comparative Analysis of Single-Feature and Multi-Feature Fusion Experiment
[0086] To further improve the ability to extract data information, this model uses the N-gram method to extract opcode sequence features and bytecode to extract grayscale image features of malicious code during data processing; then, the two are fused. To verify the effectiveness of this method, a comparative experiment was set up to compare the opcode sequence features, grayscale image features, and the mixed features. The experimental results are as follows: Figure 9 As shown,
[0087] As shown in the figure, the accuracy, precision, recall, and F1 score of the hybrid features were improved by 1.35%, 2.04%, 6.32%, and 4.85% respectively compared with the opcode features alone, and by 10.13%, 8.77%, 9.60%, and 1.12% respectively compared with the bytecode features alone.
[0088] Experimental results show that the combined opcode and grayscale image features significantly outperform any single feature, resulting in a substantial improvement in model performance and validating the effectiveness of the method. The reason for this is that opcode sequence features and grayscale image features can reflect the essence of malicious code at different scales. Combining the features extracted from both enriches the characteristic information of the malicious code, creating a complementary effect and preventing the obfuscation and packing effects of the malicious code, thus achieving better results.
[0089] Experiment 4: Validation Experiment of Bidirectional TCN:
[0090] Bidirectional temporal convolutional networks (BiTCN) can extract more comprehensive and robust features compared to unidirectional networks. Comparative experiments show that the proposed BiTCN has advantages in high accuracy and fast convergence speed, and also has certain advantages in terms of parameter size and detection speed. To verify the effectiveness of BiTCN compared to unidirectional TCN, ablation experiments were conducted on BiTCN, forward TCN, and reverse TCN. The results are as follows: Figure 10 As shown,
[0091] Depend on Figure 10 It can be seen that the bidirectional model has certain advantages over the unidirectional model in terms of accuracy, recall, precision, and F1 score in malware classification. This indicates that bidirectional fusion features are more effective for malware classification, enabling comprehensive utilization of bidirectional features and alleviating the limitations of unidirectional features in malware classification. It fully utilizes the bidirectional correlation between distance units, resulting in more balanced feature performance. The fusion of positive and negative features has a complementary effect, verifying the rationality and effectiveness of BiTCN-DLP in malware identification, which is conducive to further improving malware detection performance.
[0092] Experiment 5: Verification of the effectiveness of pooling fusion:
[0093] To address the issue of insufficient feature extraction capability of the model, a fusion of max pooling and mean pooling is adopted. To verify the effectiveness of the proposed pooling fusion method, this section presents a comparative experiment on the impact of different pooling methods on malware classification and detection. Under the same experimental conditions, the model extracts features using four different methods: no pooling, mean pooling, max pooling, and fusion pooling. The experimental results for these four schemes are as follows: Figure 11 As shown,
[0094] Depend on Figure 11 It is evident that the pooling fusion method achieves higher detection accuracy compared to methods that perform mean pooling or max pooling alone. This is because mean pooling extracts features with global significance, while max pooling extracts features with local significance; the features extracted by these two methods are significantly different.
[0095] By employing a pooling fusion method to combine two different features and complement each other, the model can fully learn the features, thereby better preserving malicious code features and effectively improving its ability to learn features, resulting in better classification performance.
[0096] Experiment 6: Model Comparison and Analysis Experiment:
[0097] To further verify the performance of the BiTCN-DLP-based malware classification model, a comparative experiment was conducted to compare this model with other malware classification models from recent years. The results are as follows: Figure 12 As shown,
[0098] As can be seen from the figure, the BiTCN-DLP-based malware classification model proposed in this paper achieves an accuracy of 99.54%, which is superior to all other methods in terms of classification accuracy.
[0099] The embodiments of the present invention are given for the purposes of illustration and description. Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.
Claims
1. A malware classification method based on bidirectional temporal convolutional networks and feature fusion, characterized in that, Includes the following steps: Step 11: Obtain the original malicious code file; Step 12: Preprocess the original malicious code file to obtain a malicious code image, which makes the model more comprehensive in extracting features of malicious code, thereby further improving the accuracy of malicious code classification and recognition. Step 13: Input the preprocessed malicious code image into a bidirectional temporal convolutional network for training. The bidirectional temporal convolutional network processes the malicious code image into data of uniform size. Step 14: Fuse the bidirectional features of uniform size through the bidirectional temporal convolutional network to obtain the data dependency between the two propagation directions; Step 15: Further feature extraction and compression of the feature map after the bidirectional temporal convolution; Step 16: Obtain the classification results of malicious code; The fusion method in step 14 is pooling fusion: the fusion pooling layer obtained by paralleling max pooling and mean pooling is used to extract deep features and further capture the dependencies within the data. The formula for pooling fusion is: Where h is the output of the bidirectional temporal convolutional network, h max It is the output of the max pooling layer, h ave It is the output of the average pooling layer, h fuse This is the output result after fusion pooling.
2. The malware classification method based on bidirectional temporal convolutional networks and feature fusion as described in claim 1, characterized in that: The data preprocessing method in step 12 includes: S121, perform batch disassembly on the PE file of the original malicious code file to obtain .asm file and .bytes file; S122, extract N-Gram opcode sequence features based on the .bytes file, and extract grayscale image texture features based on the .asm file; S123, the N-Gram opcode sequence features and the grayscale image texture features are fused to obtain a malicious code image.
3. The malware classification method based on bidirectional temporal convolutional networks and feature fusion as described in claim 1, characterized in that: The malicious code images pre-classified in step 12 are divided into a training set and a validation set. The training set is used to train the model and generate training feature vectors. The validation set is used to observe and evaluate the performance of the model and generate validation feature vectors.
4. The malware classification method based on bidirectional temporal convolutional networks and feature fusion as described in claim 3, characterized in that: The training set comprises 70%, and the validation set comprises 30%.
5. The malware classification method based on bidirectional temporal convolutional networks and feature fusion as described in claim 1, characterized in that: The method for training the bidirectional temporal convolutional network in step 13 is as follows: Step 131: Perform convolution calculation on the sequence from left to right to achieve forward feature extraction; Step 132: Perform convolution calculation on the sequence from right to left to achieve backward feature extraction.