Code provenance analysis method, electronic device, and storage medium
By processing the code grayscale matrix with an adaptive mask matrix and a nonlinear activation function, a grayscale image is generated and recognized. This solves the problem of irrelevant features affecting the accuracy in code homology analysis and improves the accuracy of the analysis results.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING TOPSEC NETWORK SECURITY TECH
- Filing Date
- 2023-10-26
- Publication Date
- 2026-07-24
AI Technical Summary
Existing code origin analysis methods suffer from inaccuracies due to the presence of numerous irrelevant features in the code.
After generating a grayscale matrix from the code to be analyzed, an adaptive mask matrix is used for processing. Then, a non-linear activation function is used to activate and map the elements to a preset pixel space to generate a grayscale image. Finally, the code family is determined through an image recognition model.
It improves the accuracy of code homology analysis, reduces the impact of irrelevant features on the analysis results, and improves the accuracy of image recognition.
Smart Images
Figure CN117406998B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer security technology, and more specifically, to code homology analysis methods, electronic devices, and storage media. Background Technology
[0002] Research has found that code from the same code family often shares many similar characteristics. For example, code from the same code family is usually quite similar in features such as system calls, key strings, code structure, symbols, and opcodes. Therefore, by analyzing these similar features, the code family to which the code belongs can be detected. This code detection method is usually called code homology analysis.
[0003] Current code origin analysis methods typically involve first converting the code into a grayscale matrix, then directly converting this grayscale matrix into a grayscale image, and finally performing image recognition on the grayscale image to determine the code family to which the code belongs. However, since codes often contain not only features similar to their code families but also a large number of unrelated features, the accuracy of the analysis results is affected by the presence of these numerous unrelated features. Summary of the Invention
[0004] The purpose of this application is to provide a code homology analysis method, electronic device, and storage medium to solve the problems in the prior art.
[0005] The first aspect of this application provides a code homology analysis method, the method comprising:
[0006] The code to be analyzed is parsed to generate a grayscale matrix of the code to be analyzed.
[0007] The grayscale matrix is processed using an adaptive mask matrix;
[0008] A non-linear activation function is used to activate each element in the processed grayscale matrix, and the activated elements are mapped to a preset pixel space to obtain the grayscale matrix after element mapping.
[0009] Convert the grayscale value matrix after element mapping into a grayscale image;
[0010] By performing image recognition on the grayscale image, the code family to which the code to be analyzed belongs can be determined.
[0011] Preferably, image recognition is performed on the grayscale image to determine the code family to which the code to be analyzed belongs, specifically including:
[0012] The grayscale image is subjected to image recognition using an image recognition model to determine the code family to which the code to be analyzed belongs.
[0013] Preferably, the method further includes:
[0014] Obtain code samples from the training set;
[0015] The code sample is parsed to generate a second grayscale matrix of the code sample;
[0016] The second grayscale matrix is processed using the mask matrix to be trained;
[0017] A non-linear activation function is used to activate each element in the processed second grayscale matrix, and the activated elements are mapped to a preset pixel space to obtain the second grayscale matrix after element mapping.
[0018] The second grayscale value matrix after element mapping is converted into a second grayscale image;
[0019] The second grayscale image is used to perform image recognition by the image recognition model to be trained, so as to obtain the recognition result;
[0020] The loss function value is determined based on the recognition result and the label in the code sample. The parameter values of the image recognition model to be trained and the values of each element in the mask matrix to be trained are adjusted by executing the backpropagation algorithm until the recognition result of the image recognition model to be trained converges. Then, the image recognition model to be trained is used as the image recognition model, and the mask matrix to be trained is used as the adaptive mask matrix.
[0021] Preferably, a nonlinear activation function is used to activate each element in the processed grayscale matrix, specifically including: using the ReLU function to activate each element in the processed grayscale matrix.
[0022] Preferably, the preset pixel space is specifically a pixel space composed of an upper limit pixel value and a lower limit pixel value; and
[0023] The activated elements are mapped to a preset pixel space, specifically including:
[0024] For each activated element, if the value of the element is less than the lower limit pixel value, the value of the element is mapped to the lower limit pixel value; or, if the value of the element is greater than the upper limit pixel value, the value of the element is mapped to the upper limit pixel value.
[0025] Preferably, the grayscale matrix is processed using an adaptive mask matrix, specifically including: performing a Hadamard product operation between the grayscale matrix and the adaptive mask matrix.
[0026] Preferably, the grayscale matrix of the code to be analyzed is generated by parsing the code, specifically including:
[0027] The code to be analyzed is read as a binary stream;
[0028] The binary stream is divided into multiple bytes to generate a byte stream of the code to be analyzed;
[0029] According to the preset matrix width, each byte in the byte stream is used as an element in the matrix to rearrange and generate a byte matrix;
[0030] Each element in the byte matrix is converted into a decimal grayscale value to generate the grayscale value matrix.
[0031] Preferably, before processing the grayscale matrix using an adaptive mask matrix, the method further includes:
[0032] Based on a pre-defined matrix length, the default rows in the grayscale matrix are filled with preset values; and,
[0033] The grayscale matrix is processed using an adaptive mask matrix, specifically including:
[0034] An adaptive mask matrix is used to process the grayscale matrix after the default row is filled.
[0035] A second aspect of this application provides an electronic device, including:
[0036] processor;
[0037] A memory for storing processor-executable instructions; wherein the processor is configured to perform the method described in any one of the first aspects of the embodiments of this application.
[0038] A third aspect of this application provides a storage medium storing a computer program that can be executed by a processor to perform the method described in any one of the first aspects of this application.
[0039] The code homology analysis method provided in this application includes first parsing the code to be analyzed to generate a grayscale matrix, then processing the grayscale matrix using an adaptive mask matrix, then activating each element in the processed grayscale matrix using a nonlinear activation function, and mapping the activated elements to a preset pixel space to obtain a grayscale matrix with element mapping, then converting the grayscale matrix with element mapping into a grayscale image, and finally performing image recognition on the grayscale image to determine the code family to which the code to be analyzed belongs. Before generating the grayscale image, this method processes the grayscale matrix using an adaptive mask matrix and then activates and maps each element in the processed grayscale matrix using a nonlinear activation function. Therefore, it can filter out data generated by irrelevant features in the code to be analyzed, thereby improving the accuracy of subsequent image recognition on the grayscale image and thus improving the accuracy of the analysis results. Attached Figure Description
[0040] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0041] Figure 1 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;
[0042] Figure 2 A schematic diagram illustrating the specific process of a code homology analysis method provided in an embodiment of this application;
[0043] Figure 3 A schematic diagram illustrating the specific process of a model and mask matrix generation method provided for another embodiment of this application;
[0044] Figure 4 This is a schematic diagram of the specific structure of a code homology analysis device provided in an embodiment of this application. Detailed Implementation
[0045] The technical solutions of the embodiments of this application will now be described with reference to the accompanying drawings. In the description of this application, terms such as "first," "second," and "third" are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance or order.
[0046] As mentioned earlier, in addition to features similar to the code family, code often contains a large number of unrelated features, such as the program's logo. Therefore, the current code homology analysis method, which converts the code into a grayscale matrix and then directly converts it into a grayscale image for image recognition, will affect the accuracy of the analysis results due to the large number of unrelated features in the code.
[0047] Based on this, embodiments of this application provide a code homology analysis method, apparatus, electronic device, and storage medium, which can be used to improve the accuracy of code homology analysis results. For example... Figure 1 As shown, this embodiment provides an electronic device 1, which includes at least one processor 11 and a memory 12. Figure 1 Taking a processor as an example, the processor 11 and the memory 12 can be connected via a bus 10. The memory 12 stores instructions that can be executed by the processor 11. The instructions are executed by the processor 11 to enable the electronic device 1 to perform all or part of the process of the method in the following embodiments.
[0048] In practical applications, the electronic device 1 can be a user-end electronic device, such as a user's mobile phone, laptop, or desktop computer. The electronic device 1 can also be a server-end electronic device, such as a server or server cluster.
[0049] This application provides a code homology analysis method, which can be used to perform code homology analysis. The method can be derived from... Figure 1 The electronic device 1 shown is used to perform this action. Figure 2 The diagram shows the specific flow of this method, which includes the following steps:
[0050] Step S21: The code to be analyzed is parsed to generate a grayscale matrix of the code to be analyzed.
[0051] Here, the code to be analyzed refers to code that requires source code analysis to determine its code family. In practical applications, depending on the specific application scenario, the code to be analyzed can be of different types. For example, in the application scenario of malicious code detection, by performing source code analysis on the code to be analyzed to determine its code family, if the code family is a malicious code family, then the code to be analyzed can be detected as malicious code.
[0052] In practical applications, step S21 can be implemented in several different ways. For example, one implementation could be to first read the code to be analyzed into a binary stream. Specifically, an electronic device can be used to read the code file of the code to be analyzed, thereby reading the code into a binary stream, which consists of multiple binary values arranged in sequence. After reading the code into a binary stream, the binary stream is further divided into multiple bytes to generate a byte stream of the code to be analyzed. For example, it can be divided into 8-bit bytes to divide the binary stream into multiple bytes. After obtaining the byte stream of the code to be analyzed... After the stream is generated, each byte in the byte stream can be used as an element in the matrix according to a pre-set matrix width, thereby rearranging and generating a byte matrix. For example, the pre-set matrix width can be 3 (this is just an example of 3, the matrix width can also be other values). At this time, starting from the first element in the byte stream, every 3 elements can be used as a row of the matrix (i.e. the matrix width is 3), thereby using each byte in the byte stream as an element in the matrix and generating the byte matrix by rearranging. After obtaining the byte matrix, each element in the byte matrix is further converted into a decimal grayscale value, thereby generating the grayscale value matrix.
[0053] The second implementation of step S21 differs from the first implementation in that, in the first implementation, after obtaining the byte stream of the code to be analyzed, each byte in the byte stream is first used as an element in the matrix according to a pre-set matrix width to generate a byte matrix, and then each element in the byte matrix is further converted into a decimal grayscale value to generate the grayscale value matrix; while in the second implementation, after obtaining the byte stream of the code to be analyzed, each byte in the byte stream can first be converted into a decimal grayscale value, and then each byte after being converted into a grayscale value is used as an element in the matrix according to a pre-set matrix width to generate the grayscale value matrix.
[0054] Step S22: Process the grayscale matrix using an adaptive mask matrix.
[0055] The adaptive mask matrix is used to extract some elements from the grayscale matrix. In the process of extracting some elements, some elements are also filtered out.
[0056] In practical applications, the width and length of the adaptive mask matrix can be the same as the width and length of the grayscale matrix. In this case, processing the grayscale matrix using the adaptive mask matrix can specifically involve performing a Hadamard product operation between the grayscale matrix and the adaptive mask matrix. For example, if both the adaptive mask matrix and the grayscale matrix are m×n matrices, performing the Hadamard product operation can be done by multiplying the elements at the same positions in both matrices and using the product as the element at the same position in the processed grayscale matrix.
[0057] It should be further explained that, considering that different codes have different lengths, when used as the code to be analyzed and analyzed using the method in this application, the number of elements in the grayscale matrix generated by different codes will be different, which will lead to differences in the rows and columns of the matrix and affect the efficiency of code analysis. Therefore, in this embodiment of the application, before step S22, the default rows in the grayscale matrix can be filled with preset values according to the preset matrix length. The preset values can be 0, 255 or other values.
[0058] For example, in practical applications, the matrix width (i.e., the number of columns) and matrix length (i.e., the number of rows) can be preset. In step S21 above, a grayscale matrix with the preset matrix width can be generated. Before step S22, the default rows in the grayscale matrix are further filled using preset values based on the preset matrix length, resulting in a grayscale matrix with the default rows filled. Of course, step S22 can specifically involve processing the grayscale matrix with the default rows filled using an adaptive mask matrix, such as performing a Hadamard product operation between the grayscale matrix with the default rows filled and the adaptive mask matrix.
[0059] Step S23: Activate each element in the processed grayscale matrix using a non-linear activation function, and map the activated elements to a preset pixel space to obtain the grayscale matrix after element mapping.
[0060] The nonlinear activation function can be, for example, the ReLU function, the sigmoid function, or other nonlinear activation functions; there is no limitation on this. Therefore, activating each element in the processed grayscale matrix using a nonlinear activation function can specifically involve using the ReLU function, the sigmoid function, etc., to activate each element in the processed grayscale matrix.
[0061] The preset pixel space can be specifically a pixel space composed of an upper limit pixel value and a lower limit pixel value. For example, the lower limit pixel value can be 0 and the upper limit pixel value can be 255. In this case, the preset pixel space can be [0, 255].
[0062] In step S23, the specific method for activating each element in the processed grayscale matrix using a nonlinear activation function can be as follows: for each element in the processed grayscale matrix, substitute the element into the nonlinear activation function for activation calculation; and map each activated element to a preset pixel space. Specifically, for each activated element, first determine whether the value of the element belongs to the preset pixel space. If so, multiply the value of the element by an amplification factor (e.g., 1) to obtain the mapped value; if not, if the value of the element is less than the lower limit pixel value, map the value of the element to the lower limit pixel value, or if the value of the element is greater than the upper limit pixel value, map the value of the element to the upper limit pixel value.
[0063] For example, the preset pixel space can be [0, 255]. In this case, for each activated element, first determine whether the value of the element belongs to the preset pixel space [0, 255]. If the value of the element is less than 0, then the value of the element is mapped to 0. If the value of the element is greater than 255, then the value of the element is mapped to 255. If the value of the element is greater than or equal to 0 and less than or equal to 255, then the value of the element can be multiplied by 1 to obtain the mapped value. In this way, by performing this mapping on each element, the gray value matrix after element mapping can be obtained.
[0064] Step S24: Convert the grayscale value matrix after element mapping into a grayscale image.
[0065] In step S24, each element in the grayscale value matrix after element mapping can be used as the grayscale value at the corresponding position, thereby converting it into a grayscale image.
[0066] Step S25: By performing image recognition on the grayscale image, determine the code family to which the code to be analyzed belongs.
[0067] After obtaining the grayscale image through step S24, in step S25, the code family to which the code to be analyzed belongs can be determined by performing image recognition on the grayscale image. Specifically, the grayscale image can be recognized by using an image recognition model to determine the code family to which the code to be analyzed belongs. For example, the grayscale image can be input into the image recognition model to obtain the recognition result output by the image recognition model, which is the code family to which the code to be analyzed belongs.
[0068] The image recognition model can be a convolutional neural network or other types of models, which are not limited here.
[0069] The method provided in this application includes first parsing the code to be analyzed to generate a grayscale matrix of the code; then processing the grayscale matrix using an adaptive mask matrix; then activating each element in the processed grayscale matrix using a nonlinear activation function; and finally mapping the activated elements to a preset pixel space to obtain a grayscale matrix with element mapping. The element-mapped grayscale matrix is then converted into a grayscale image, and finally, image recognition is performed on the grayscale image to determine the code family to which the code to be analyzed belongs. Before generating the grayscale image, this method processes the grayscale matrix using an adaptive mask matrix and then activates and maps each element in the processed grayscale matrix using a nonlinear activation function. Therefore, it can filter out data generated by irrelevant features in the code to be analyzed, thereby improving the accuracy of subsequent image recognition on the grayscale image and ultimately improving the accuracy of the analysis results.
[0070] It should be further explained that the image recognition model and adaptive mask matrix mentioned in the above steps can be pre-generated using steps S31 to S3 of the model and mask matrix generation method described below. For example, the image recognition model and adaptive mask matrix can be pre-generated using this model and mask matrix generation method, and then in steps S21 to S25 above, the image recognition model and adaptive mask matrix can be obtained, and steps S21 to S25 can be executed. Figure 3 The diagram shows the specific process flow of the model and mask matrix generation method, including:
[0071] Step S31: Obtain code samples from the training set.
[0072] The training set includes multiple code samples. The code samples can be obtained from the training set by randomly selecting them or by obtaining them in a preset order.
[0073] Step S32: Generate a second grayscale matrix of the code sample by parsing the code sample.
[0074] Based on the same implementation principle, the specific implementation of step S32 can refer to the content of step S21 above. For example, the code sample can be read as a binary stream first, and then the binary stream can be further divided into multiple bytes to generate the byte stream of the code to be analyzed. Then, according to the preset matrix width, each byte in the byte stream is used as an element in the matrix to rearrange and generate a byte matrix. Then, each element in the byte matrix is converted into a decimal grayscale value to generate the second grayscale matrix. For example, the second grayscale matrix can be an m×n matrix.
[0075] Step S33: Process the second grayscale matrix using the mask to be trained.
[0076] The adaptive mask matrix is generated by training the mask to be trained. Therefore, the matrix structure of the mask to be trained, including the number of rows and columns, is the same as that of the adaptive mask matrix. For example, an m×n matrix can be created and the values of each element in the matrix can be initialized to serve as the mask to be trained.
[0077] Based on the same implementation principle, the specific implementation of step S33 can refer to the content of step S22 above. In practical applications, the width and length of the mask to be trained can be the same as the width and length of the second gray value matrix. In this case, processing the second gray value matrix using the mask to be trained can specifically involve performing a Hadamard product operation between the second gray value matrix and the mask to be trained.
[0078] Step S34: Activate each element in the processed second grayscale matrix using a non-linear activation function, and map the activated elements to a preset pixel space to obtain the second grayscale matrix after element mapping.
[0079] Based on the same implementation principle, the specific implementation method of step S34 can be referred to the content of step S23 above, and will not be repeated here.
[0080] Step S35: Convert the second grayscale value matrix after element mapping into a second grayscale image.
[0081] Based on the same implementation principle, the specific implementation method of step S35 can be referred to the content of step S24 above, and will not be repeated here.
[0082] Step S36: Perform image recognition on the second grayscale image using the image recognition model to be trained, so as to obtain the recognition result.
[0083] The image recognition model is generated by training the image recognition model to be trained. In step S36, the second grayscale image can be input into the image recognition model to be trained to obtain the output of the image recognition model, which is used as the recognition result.
[0084] Step S37: Determine the loss function value based on the recognition results and the labels in the code samples, and adjust the parameter values of the image recognition model to be trained and the values of each element in the training mask by executing the backpropagation algorithm.
[0085] After obtaining the recognition result through step S36 above, the loss function value can be determined based on the recognition result and the label in the code sample. For example, the two can be substituted into the preset loss function to calculate the loss function value. After obtaining the loss function value, the backpropagation algorithm is further executed to adjust the parameter values of the image recognition model to be trained and the values of each element in the mask to be trained.
[0086] Of course, after adjusting the parameter values of the image recognition model to be trained and the values of each element in the mask to be trained, it is possible to further detect whether the recognition result of the image recognition model to be trained has converged. If it has converged, the image recognition model to be trained is used as the image recognition model mentioned above, and the mask to be trained is used as the adaptive mask matrix mentioned above. If it has not converged, steps S31 to S37 can be re-executed until the recognition result of the image recognition model to be trained converges. Then, the image recognition model to be trained is used as the image recognition model, and the mask to be trained is used as the adaptive mask matrix, thereby finally generating the image recognition model and the adaptive mask matrix.
[0087] The above is a detailed description of the code homology analysis method provided in the embodiments of this application. In practical applications, this code homology analysis method can typically be applied to malicious code identification scenarios. For example, malicious code from various code families can be collected in advance, and then code samples can be generated using these malicious codes. Then, through the steps S31 to S37 described above, an image recognition model and an adaptive mask matrix can be generated in advance. In this way, the code family to which the code to be analyzed belongs can be further identified using the steps S21 to S25 described above. If the code family to which the code to be analyzed belongs belongs to a malicious code family, then it can be concluded that the code to be analyzed is malicious code.
[0088] Based on the same inventive concept as the code homology analysis method provided in the embodiments of this application, the embodiments of this application also provide a code homology analysis apparatus. For any unclear aspects of this apparatus embodiment, please refer to the corresponding content of the method embodiment. Figure 4 The diagram shows the specific structure of the device 40, which includes: a grayscale matrix generation unit 401, a mask matrix processing unit 402, an activation mapping unit 403, a grayscale image conversion unit 404, and a code family determination unit 405, wherein:
[0089] The grayscale matrix generation unit 401 is used to generate a grayscale matrix of the code to be analyzed by parsing the code to be analyzed.
[0090] The mask matrix processing unit 402 is used to process the gray value matrix using an adaptive mask matrix;
[0091] The activation mapping unit 403 is used to activate each element in the processed grayscale matrix using a non-linear activation function, and map each activated element to a preset pixel space to obtain the grayscale matrix after element mapping.
[0092] The grayscale image conversion unit 404 is used to convert the grayscale value matrix after element mapping into a grayscale image;
[0093] The code family determination unit 405 is used to determine the code family to which the code to be analyzed belongs by performing image recognition on the grayscale image.
[0094] The apparatus 40 provided in the embodiments of this application adopts the same inventive concept as the code homology analysis method provided in the embodiments of this application. Under the premise that the method can solve the technical problem, the apparatus 40 can also solve the technical problem, which will not be elaborated here.
[0095] In addition, in practical applications, the technical effects achieved by combining the device 40 with specific hardware devices, cloud technology, etc., are also within the scope of protection of this application. For example, using a distributed cluster approach to deploy different units in the device 40 in different nodes of the distributed cluster to improve efficiency; or deploying some units in the device 40 in the cloud to reduce costs.
[0096] The code family determination unit 405 may specifically include a code family determination subunit, which is used to perform image recognition on the grayscale image through an image recognition model in order to determine the code family to which the code to be analyzed belongs.
[0097] The device may further include a model and a mask matrix generation unit for obtaining code samples from a training set; generating a second grayscale matrix of the code samples by parsing the code samples; processing the second grayscale matrix using a mask matrix to be trained; activating each element in the processed second grayscale matrix using a nonlinear activation function, and mapping each activated element to a preset pixel space to obtain a second grayscale matrix after element mapping; converting the second grayscale matrix after element mapping into a second grayscale image; performing image recognition on the second grayscale image using an image recognition model to be trained to obtain a recognition result; determining a loss function value based on the recognition result and the labels in the code samples, and adjusting the parameter values of the image recognition model to be trained and the values of each element in the mask matrix to be trained by executing a backpropagation algorithm until the recognition result of the image recognition model to be trained converges; using the image recognition model to be trained as the image recognition model and the mask matrix to be trained as the adaptive mask matrix.
[0098] Specifically, activating each element in the processed grayscale matrix using a nonlinear activation function can include activating each element in the processed grayscale matrix using the ReLU function.
[0099] The preset pixel space is specifically a pixel space composed of an upper limit pixel value and a lower limit pixel value; and mapping each activated element to the preset pixel space may specifically include: for each activated element, if the value of the element is less than the lower limit pixel value, mapping the value of the element to the lower limit pixel value; or, if the value of the element is greater than the upper limit pixel value, mapping the value of the element to the upper limit pixel value.
[0100] The mask matrix processing unit 402 may specifically include a mask matrix processing subunit, which is used to perform a Hadamard product operation on the gray value matrix and the adaptive mask matrix.
[0101] The grayscale matrix generation unit 401 may specifically include a grayscale matrix generation subunit, used to read the code to be analyzed as a binary stream; divide the binary stream into multiple bytes to generate a byte stream of the code to be analyzed; rearrange each byte in the byte stream as an element in the matrix according to a preset matrix width to generate a byte matrix; and convert each element in the byte matrix into a decimal grayscale value to generate the grayscale matrix.
[0102] The device 40 may further include a default value filling unit, used to fill the default rows in the grayscale value matrix with preset values according to a preset matrix length before processing the grayscale value matrix using the adaptive mask matrix; and, processing the grayscale value matrix using the adaptive mask matrix may specifically include: processing the grayscale value matrix after the default rows are filled using the adaptive mask matrix.
[0103] This invention also provides a storage medium storing a computer program that can be executed by a processor to complete all or part of the methods described in this application. The storage medium can be a disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc. The storage medium may also include combinations of the above types of memory.
[0104] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.
Claims
1. A code homology analysis method, characterized in that, The method includes: The code to be analyzed is parsed to generate a grayscale matrix of the code to be analyzed. The grayscale matrix is processed using an adaptive mask matrix; A non-linear activation function is used to activate each element in the processed grayscale matrix, and the activated elements are mapped to a preset pixel space to obtain the grayscale matrix after element mapping. Convert the grayscale value matrix after element mapping into a grayscale image; By performing image recognition on the grayscale image, the code family to which the code to be analyzed belongs can be determined; By performing image recognition on the grayscale image, the code family to which the code to be analyzed belongs is determined, specifically including: The grayscale image is subjected to image recognition using an image recognition model to determine the code family to which the code to be analyzed belongs. The method further includes: Obtain code samples from the training set; The code sample is parsed to generate a second grayscale matrix of the code sample; The second grayscale matrix is processed using the mask matrix to be trained; A non-linear activation function is used to activate each element in the processed second grayscale matrix, and the activated elements are mapped to a preset pixel space to obtain the second grayscale matrix after element mapping. The second grayscale value matrix after element mapping is converted into a second grayscale image; The second grayscale image is used to perform image recognition by the image recognition model to be trained, so as to obtain the recognition result; The loss function value is determined based on the recognition result and the label in the code sample. The parameter values of the image recognition model to be trained and the values of each element in the mask matrix to be trained are adjusted by executing the backpropagation algorithm until the recognition result of the image recognition model to be trained converges. Then, the image recognition model to be trained is used as the image recognition model, and the mask matrix to be trained is used as the adaptive mask matrix. The preset pixel space is specifically a pixel space composed of an upper limit pixel value and a lower limit pixel value; and The activated elements are mapped to a preset pixel space, specifically including: For each activated element, if the value of the element is less than the lower limit pixel value, the value of the element is mapped to the lower limit pixel value; or, if the value of the element is greater than the upper limit pixel value, the value of the element is mapped to the upper limit pixel value.
2. The method according to claim 1, characterized in that, The elements in the processed grayscale matrix are activated using a nonlinear activation function, specifically by using the ReLU function to activate each element in the processed grayscale matrix.
3. The method according to claim 1, characterized in that, The grayscale matrix is processed using an adaptive mask matrix, specifically by performing a Hadamard product operation between the grayscale matrix and the adaptive mask matrix.
4. The method according to claim 1, characterized in that, The process involves parsing the code to be analyzed to generate a grayscale matrix of the code, specifically including: The code to be analyzed is read as a binary stream; The binary stream is divided into multiple bytes to generate a byte stream of the code to be analyzed; According to the preset matrix width, each byte in the byte stream is used as an element in the matrix to rearrange and generate a byte matrix; Each element in the byte matrix is converted into a decimal grayscale value to generate the grayscale value matrix.
5. The method according to claim 1, characterized in that, Before processing the grayscale matrix using an adaptive mask matrix, the method further includes: Based on a pre-defined matrix length, the default rows in the grayscale matrix are filled with preset values; and, The grayscale matrix is processed using an adaptive mask matrix, specifically including: An adaptive mask matrix is used to process the grayscale matrix after the default row is filled.
6. An electronic device, characterized in that, include: processor; Memory for storing processor-executable instructions; wherein the processor is configured to perform the method as described in any one of claims 1-5.
7. A storage medium, characterized in that, The storage medium stores a computer program that can be executed by a processor to perform the method described in any one of claims 1-5.