A Visual Classification Method for Malicious Code

Abstract

This invention relates to the field of malware classification technology, and more particularly to a malware visualization and classification method. The technical solution includes the following steps: Step S1, Data Preparation: Obtain a malware dataset and convert the binary files into grayscale images; Step S2, Feature Extraction: Extract image features using a ResNet-based backbone network; Step S3, MA Module: Employ a multi-scale convolutional MA module to reduce the dimensionality of the feature maps, decrease computational load, and extract local features; Step S4, CA Module: Use an attention channel module to assign weights to the feature map channels; Step S5, Classifier Training and Prediction. This invention constructs a new malware visualization dataset based on the BODMAS dataset, providing a solid data foundation for subsequent researchers, while simultaneously focusing on both local and global feature information, thus improving classification accuracy.

Description

Technical Field

[0001] This invention relates to the field of malicious code classification technology, and in particular to a method for visually classifying malicious code. Background Technology

[0002] With the rapid development of internet technology, computer viruses have become a serious global threat, posing significant risks to the information security of governments, businesses, and individual users. Furthermore, the continuous emergence of new malicious code, especially variants capable of circumventing antivirus software, presents a major challenge to malware prevention efforts. Research into classifying and summarizing malware families, and quickly and accurately identifying known malware families and their derivative variants, will greatly enhance the ability to defend against malware.

[0003] The combination of malware visualization and deep learning has become a mainstream method for malware classification and detection. Currently, deep learning techniques such as convolutional neural networks and recurrent neural networks have become a focus of extensive research. These techniques can automatically learn features from datasets and achieve efficient malware classification and detection. Therefore, deep learning-based malware detection has developed rapidly. The main methods involve converting malware into grayscale or color images and feeding them into deep learning models for feature learning and classification.

[0004] Among existing methods for visualizing and classifying malware, this one has shown good results in malware classification, for example:

[0005] By generating grayscale images using disassembled machine code, with each line representing one line of machine code, good interpretability is demonstrated.

[0006] The CNN method was improved by using RGB image features to represent malware, enhancing semantic relationships, addressing the confusion problem, and improving the CNN model to avoid information loss.

[0007] A visualization analysis method based on the binary sequence of malware is proposed by distinguishing characters by filling them with different colors, visualizing them using space-filling curves, and using a VGG19 convolutional neural network for learning and classification.

[0008] Using assembly code, word vectors are obtained through the Word2Vec algorithm, converted into grayscale images, and then used CNN for malware classification.

[0009] Extracting representative malicious family byte sequences using CNNs with attention mechanisms can aid in malware analysis.

[0010] A malware classification framework based on grayscale image and texture segmentation is adopted, and a specially designed CNN is used for learning and classification.

[0011] However, the above methods are generally inefficient and inaccurate in identifying and classifying malicious code. Therefore, this application proposes a visual classification method for malicious code. Summary of the Invention

[0012] The purpose of this invention is to address the problem that the accuracy of malicious code visualization classification in the background art is generally low, and to propose a malicious code visualization classification method.

[0013] The technical solution of this invention: a method for visually classifying malicious code, comprising the following steps:

[0014] Step S1, Data Preparation: Obtain the malicious code dataset and convert the binary files into grayscale images;

[0015] Step S2, Feature Extraction: Extract image features using a ResNet-based backbone network;

[0016] Step S3, MA module: The MA module, which uses multi-scale convolution operations, reduces the dimensionality of the feature map, reduces the amount of computation, and extracts local features;

[0017] Step S4, CA module: The attention channel module is used to assign weights to the feature map channels;

[0018] Step S5, Classifier Training and Prediction: Using the extracted feature maps as input, the classifier model is used for training and prediction.

[0019] Optionally, step S1 includes reading a binary file, converting it into an unsigned integer variable to represent pixel grayscale values, mapping the grayscale values ​​to convert them into a grayscale image, and saving it.

[0020] Optionally, in step S2, the residual learning module of ResNet is used to learn the residual of the input image through a multi-layer structure, and the learned feature representation from the l-th layer to the L-th layer is obtained.

[0021] Optionally, step S4 specifically includes the following steps:

[0022] Step S401: Obtain two channel weight vectors through global pooling and average pooling, and then perform softmax normalization;

[0023] Step S402: Then, the channel weights are multiplied and superimposed with the previous feature maps to obtain the final weighted feature map.

[0024] Optionally, in step S5, the classifier includes support vector machine (SVM), random forest, and convolutional neural network (CNN).

[0025] Optionally, the residual learning module includes a residual network structure, the formula of which is as follows:

[0026] h(x l )=F(x l W l (1)

[0027] x l+1 =f(y l (2)

[0028] Where x l and x l+1 These represent the input and output of the l-th residual unit, respectively. Each residual unit contains multiple layers of structure, F(x) l W l f(y) is the residual function, representing the learned residual, i.e., the residual for input f(y). l A fine-tuning of h(x), while h(x) l ) represents x l The identity mapping, f(y) l ) is the ReLU activation function. Based on formulas (1) and (2), the learned features from layer l to layer l are obtained as follows:

[0029]

[0030] The chain rule is used to inversely differentiate formula (3);

[0031]

[0032] Optionally, the MA module includes a GC module, which first performs multi-scale convolutional dimensionality reduction on the input feature map X to obtain x. i =[x1,x2,...,x d ], then x i After expanding its dimensions with a fully connected layer and then splicing them together:

[0033]

[0034] Compared with the prior art, the present invention has the following beneficial technical effects:

[0035] This invention addresses the issue that existing visualized malware datasets are no longer sufficient for algorithms to learn and train on novel malware features. Based on the BODMAS dataset, this invention constructs a new malware visualization dataset, providing a solid data foundation for subsequent researchers.

[0036] This invention addresses the issue that existing models only focus on their global features by proposing a CA module (channel-level local feature attention module) and an MA module (multi-scale local feature attention module), which simultaneously pay attention to both local and global feature information, thereby improving classification accuracy. Attached Figure Description

[0037] Figure 1 This is an overview diagram of the classification model for visualizing malicious virus code in this invention;

[0038] Figure 2 This is a grayscale image of the Backdoo virus code.

[0039] Figure 3 This is a grayscale image of the downloader virus code;

[0040] Figure 4 This is a diagram of the residual network structure.

[0041] Figure 5 This is a diagram of the MA module;

[0042] Figure 6 This is a diagram of the CA module. Detailed Implementation

[0043] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0044] Example

[0045] 1.1 Model Overview

[0046] To implement a classification model for visualizing malicious virus code, this embodiment designs a model based on the ResNet architecture as follows: Figure 1 The baseline model structure shown mainly includes a preprocessing layer, a ResNet backbone layer, a neck layer, and an output layer. In the backbone layer, this embodiment adds a CA module (channel-level local feature attention module) and an MA module (multi-scale local feature attention module) to effectively utilize global and local features.

[0047] 1.2 Data Analysis and Preprocessing

[0048] Analysis of the BODMAS dataset revealed that most variants of similar malware are generated using automated techniques or by reusing key modules, resulting in significant similarities between the binary code. Consequently, the generated grayscale images exhibit highly similar characteristics. Furthermore, the dataset samples studied in this embodiment are PE malware. PE files possess a clear structure and contain rich information; their generated grayscale images are structured, enabling effective extraction of local features. Additionally, disassembling the dataset samples revealed that the average disassembled code length for each sample reaches approximately 20,000 lines, interspersed with code that attackers might use to mislead analysts. Moreover, the dataset authors extracted sample features using the Life platform, a time-consuming and labor-intensive process. For these reasons, this embodiment attempts to visualize the dataset samples and classify them using a deep learning model.

[0049] This embodiment converts the image to grayscale using the following steps: The binary file is read and converted into an unsigned integer variable, with a range of [0, 255], using 8 bits as a basic unit. This integer variable represents the grayscale value of a pixel in the image. The mapping rule is: 255 represents pure white, and 0 represents pure black. It is then mapped to grayscale and saved as a PNG image.

[0050] according to Figure 2 and Figure 3 The observations in this embodiment revealed significant differences in the grayscale images of different virus codes. Grayscale images from the same family showed similarities. Therefore, based on these findings, this embodiment constructed a new visualized malware dataset.

[0051] 1.3 Backbone Network for Feature Extraction Based on ResNet

[0052] To address the vanishing or exploding gradients caused by excessively deep models in traditional convolutional neural networks, ResNet introduced residual networks. The structure of a residual network is as follows: Figure 4 As shown, its formula is as follows:

[0053] h(x l )=F(x l W l (1)

[0054] x l+1 =f(y l (2)

[0055] Where x l and x l+1 These represent the input and output of the l-th residual unit, respectively. Note that each residual unit typically contains multiple layers. F(x) l Wl f(y) is the residual function, representing the learned residual, which can be viewed as the result of the input f(y). l A fine-tuning of h(x), while h(x) l ) represents x l The identity mapping, f(y) l ) is the ReLU activation function. Based on formulas (1) and (2), the learned features from layer l to layer l can be obtained as follows:

[0056]

[0057] The chain rule is used to inversely differentiate formula (3);

[0058]

[0059] Formula (4) can guarantee that the gradient can be propagated without loss, so the model can continuously deepen the network layers.

[0060] 1.4MA module

[0061] Malicious code visualization graph classification falls under the category of fine-grained image classification. Therefore, it is crucial that the model focuses on local features. This embodiment proposes decomposing the convolution operation into multiple smaller convolution operations, each focusing on only a subset of features. Therefore, this embodiment designs a GC module. For example... Figure 5 As shown, this module first performs multi-scale convolutional dimensionality reduction on the input feature map X to obtain x. i =[x1,x2,...,x d ], then x i After expanding its dimensions with a fully connected layer and then splicing them together:

[0062]

[0063] This not only reduces the amount of computation but also further extracts local feature information from the image.

[0064] 1.5 CA Module

[0065] The findings of this embodiment demonstrate that not all feature channels are equivalent, and some feature channels focus more on key local information.

[0066] Therefore, this embodiment designs an attention channel module. For example... Figure 6 As shown: First, global pooling and average pooling are performed on the feature map channels to obtain two 1xC channel weight vectors f. max and f avg Then, a softmax operation is performed to obtain different weights for each channel. Then, f... max and f avgMultiply the feature map with the previous feature map and then superimpose the two feature maps.

[0067] To verify the technical effects of the present invention, experiments and analyses were conducted on the technical solution.

[0068] 2.1 Dataset Design

[0069] The experimental dataset is divided into training data and prediction dataset. This embodiment uses the BODMAS dataset, which has a total of 134,435 samples, of which 77,142 are benign and 57,293 are malicious. Since the goal is to study malicious virus classification, this embodiment focuses on malicious samples. These samples are divided into 14 categories, with the most common categories being Trojans (29,972 samples), worms (16,697 samples), backdoors (7,331 samples), downloaders (1,031 samples), and ransomware (821 samples). Specific information is shown in Table 1.

[0070] Table 1 Information on Malicious Virus Types

[0071]

[0072] These categories can be further subdivided into 581 families, many of which have only one or two samples, making them unrepresentative. Therefore, this embodiment selects families with more than 100 samples (57 families in total) to create a new dataset. Some family information is shown in Table 2:

[0073] Table 2 contains information on some malware families.

[0074]

[0075]

[0076] In this embodiment, following the rules of general datasets, the samples are divided into training and testing sets in an 8:2 ratio. Virus types and families are trained separately for each set.

[0077] 2.2 Experimental Environment

[0078] This experiment was run on a Linux operating system, using Python 3.8 as the programming language, with PyTorch 2.0.1 as the deep learning framework, an NVIDIA RTX 3090 GPU, and CUDA 11.7 as the GPU driver.

[0079] 2.3 Experimental Results and Analysis

[0080] 2.3.1 Model Evaluation Indicators

[0081] The ultimate goal of this embodiment is to extract image features more deeply from the created dataset. Therefore, the main evaluation metrics of this experiment are accuracy and F1 score. The calculation methods are shown in formulas (6) to (8), where TP and TN represent the number of true positives and true negatives, and FP and FN represent the number of false positives and false negatives.

[0082]

[0083]

[0084]

[0085] 2.3.2 Experimental Configuration and Parameter Settings

[0086] In this experiment, the hyperparameters used in the ResNet50 model are described in detail, as shown in Table 3.

[0087] Table 3 Model Parameters

[0088]

[0089]

[0090] 2.3.3 Experimental Results

[0091] The BODMAS paper's method extracts malicious code features using security software and then uses GBDT for classification. This process is time-consuming and labor-intensive. In contrast, this embodiment designs two new models to classify the dataset based on the visualization of malicious code. Table 4 shows that ResNet50 performs well on the BODMAS dataset, achieving a category accuracy of 87.42% and a family accuracy of 81.98%, close to the baseline results provided in the paper. This verifies the effectiveness of using the visual features of malicious code for classification.

[0092] Table 4 Results of models at different depths

[0093]

[0094] Building upon this foundation, this study introduces MA and CA modules to capture features at different scales and enhance attention to effective features. Results show that the MA module improves the accuracy for categories and families to 89.22% and 86.49%, respectively, while the CA module improves them to 91.07% and 87.70%. Furthermore, the F1 score is significantly improved, with balanced F1 scores of 91.30% and 87.71% for categories and families, respectively. This indicates that the new model based on the CA module has a more balanced ability to identify and classify different types and families of malware, and the false positive rate is also reduced. Overall, the experiments fully validate the effectiveness of the method presented in this embodiment. By combining visualization and deep learning techniques, and with the addition of MA and CA modules, the model's ability to identify and classify malware families is significantly improved. This lays the foundation for rapid and automated analysis of unknown malware.

[0095] The above specific embodiments are merely several optional embodiments of the present invention. Based on the technical solutions of the present invention and the relevant teachings of the above embodiments, those skilled in the art can make various alternative improvements and combinations to the above specific embodiments.

Claims

1. A method for visually classifying malicious code, characterized in that, Includes the following steps: Step S1, Data Preparation: Obtain the malicious code dataset and convert the binary files into grayscale images; Step S2, Feature Extraction: Extract image features using a ResNet-based backbone network; Step S3, MA module: The MA module, which uses multi-scale convolution operations, reduces the dimensionality of the feature map, reduces the amount of computation, and extracts local features; Step S4, CA module: The attention channel module is used to assign weights to the feature map channels; Step S5, Classifier Training and Prediction: Using the extracted feature maps as input, the classifier model is used for training and prediction; Step S4 specifically includes the following steps: Step S401: Obtain two channel weight vectors through global pooling and average pooling, and then perform softmax normalization; Step S402: Then, the channel weights are multiplied by the previous feature maps and superimposed to obtain the final weighted feature map. The MA module includes a GC module, which processes the input feature map. Multi-scale convolution dimensionality reduction is performed to obtain After that After expanding its dimensions through a fully connected layer and then weighted and fused: （5）。 2. The malicious code visualization and classification method according to claim 1, characterized in that, Step S1 includes reading a binary file, converting it into an unsigned integer variable to represent pixel grayscale values, mapping the grayscale values ​​to convert them into a grayscale image, and saving it.

3. The malicious code visualization and classification method according to claim 1, characterized in that, In step S2, the residual learning module of ResNet is used to learn the residual of the input image through a multi-layer structure, and the learned feature representation from the l-th layer to the L-th layer is obtained.

4. The malicious code visualization and classification method according to claim 1, characterized in that, In step S5, the classifier includes support vector machine, random forest, and convolutional neural network.

5. The malicious code visualization and classification method according to claim 3, characterized in that, The residual learning module includes a residual network structure, the formula of which is as follows: （1） （2） in and They represent the first The inputs and outputs of each residual unit, each residual unit containing a multi-layer structure. It is a residual function, representing the learned residual, that is, the residual of the input. A minor adjustment, and express The identity mapping, It is the ReLU activation function. Based on formulas (1) and (2), we obtain the activation function from the l-th layer to the 1-th layer. The learning characteristics of the layer are: （3） Take the inverse derivative of formula (3) using the chain rule; (4)。

Images