A malware classification method, system, device and program product

Abstract

The present invention belongs to the field of computer information security technology, and its purpose is to provide a malware classification method, system, device and program product. The present invention adopts two data modalities, image features corresponding to the binary grayscale image of malware and API sequence features corresponding to the API call sequence during software runtime, as the basic data for malware classification for the first time, and obtains shallow fusion multimodal features and deep fusion multimodal features by performing shallow fusion processing and deep fusion processing on the image features and the API sequence features. Finally, according to the shallow fusion multimodal features and the deep fusion multimodal features, a prototype network model is used to obtain the classification category of the malware to be classified. The present invention uses a prototype network to achieve rapid classification of unknown malware in a small sample environment, which can fully mine the information in a limited sample and improve the accuracy of classifying unknown malware.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer information security, and in particular relates to a malware classification method, system, device and program product. Background Art

[0002] In recent years, with the rapid development of information technologies such as artificial intelligence and the Internet of Things, the demand and popularity of intelligent systems have continued to increase. Although these technologies are gradually being widely used and are even regarded as a revolution in the field of intelligent systems, this also makes such devices more vulnerable to hacker attacks, resulting in a significant increase in the number of malware, threatening the privacy and security of individual users. Malware refers to software that is installed and run on a user's computer or other terminal without explicit prompting or permission from the user, infringing on the user's legitimate rights and interests. It generally includes computer viruses, worms, Trojan horses (such as backdoors, mining programs, ransomware), etc. In addition, malware in a broad sense also includes scripts (commonly referred to as malicious code) that can exploit vulnerabilities to upload malware or perform malicious behaviors. Malware usually poses multiple threats and can affect the normal use of the user's computer or steal various resources on the user's computer through various methods or channels.

[0003] At present, the number of malware and the economic losses it causes worldwide are growing in proportion. At the same time, because attackers continue to write new malware and use it to launch large-scale network attacks against intelligent systems, most companies, government agencies and network users are still facing security threats from unknown malware. In addition, all kinds of intelligent services or systems are suffering from attacks from various malware around the world. Therefore, it is very important to study malware detection and classification methods. By studying these methods, we can better protect users' computer systems and privacy security and reduce the losses and impacts caused by malware attacks on individuals and enterprises.

[0004] Malware classification aims to identify and distinguish the characteristics and behaviors that cause harm to computer systems, so as to achieve real-time and efficient security protection for the system. In traditional technology, malware classification has always adopted a signature-based detection method, that is, matching malware samples with predefined signatures or patterns to achieve malware classification.

[0005] However, in the process of using the prior art, the inventors found that the prior art has at least the following problems:

[0006] Traditional signature-based detection methods cannot detect malware that has never been seen before or zero-day malware. The large number of newly emerging unknown malware makes the effectiveness of malware classification based on signature-based detection methods limited, and it is impossible to accurately classify malware, which poses a major threat to network security. The network security community has been actively exploring advanced technologies such as machine learning and deep learning to improve the accuracy and agility of malware classification, mainly using various neural networks to extract features for classification. However, due to the need for frequent retraining on large data sets, traditional machine learning models often have difficulty keeping up with the ever-changing pace of malware. In addition, current research does not fully utilize multi-source data features, which limits the in-depth understanding of malware behavior and makes it difficult to cope with the ever-evolving characteristics of malware. Summary of the invention

[0007] The present invention aims to solve the above technical problems at least to a certain extent. The present invention provides a malware classification method, system, device and program product.

[0008] In order to achieve the above object, the present invention adopts the following technical solutions:

[0009] In a first aspect, the present invention provides a malware classification method, comprising:

[0010] Extracting a binary byte sequence from an executable file of the malware to be classified, and performing image conversion on the binary byte sequence to obtain a grayscale image;

[0011] Performing API call analysis and processing on the malware to be classified to obtain an API call sequence of the malware to be classified;

[0012] Performing feature extraction on the grayscale image and the API call sequence to obtain feature data of the malware to be classified; wherein the feature data includes image features corresponding to the grayscale image and API sequence features corresponding to the API call sequence;

[0013] Performing shallow fusion processing on the image features and the API sequence features to obtain shallow fused multimodal features;

[0014] Performing deep fusion processing on the image features and the API sequence features to obtain multimodal features after deep fusion;

[0015] According to the shallowly fused multimodal features and the deeply fused multimodal features, a prototype network model is used to obtain the classification category of the malware to be classified.

[0016] In a possible design, the API call analysis process is performed on the malware to be classified to obtain the API call sequence of the malware to be classified, including:

[0017] Executing the malware to be classified in a preset virtual environment to obtain an analysis report;

[0018] Connecting the initial API call sequences of the multiple processes in the analysis report to obtain a connected API call sequence;

[0019] Preprocessing the post-connection API call sequence to obtain a preprocessed API call sequence;

[0020] The pre-processed API call sequence is processed using an N-gram algorithm to obtain a final API call sequence.

[0021] In a possible design, feature extraction is performed on the grayscale image and the API call sequence to obtain feature data of the malware to be classified, including:

[0022] Performing image enhancement processing on the grayscale image to obtain an enhanced grayscale image;

[0023] Using a text semantic perception-based CLIP-ResNet50 model to extract features from the enhanced grayscale image to obtain image features corresponding to the enhanced grayscale image; wherein the CLIP-ResNet50 model includes a first convolutional layer, a second convolutional layer, a third convolutional layer and a linear layer connected in sequence;

[0024] Based on a preset word dictionary, the API call sequence is word embedded to obtain an embedding matrix, and a lightweight Transformer encoder is used to extract features from the embedding matrix to obtain API sequence features; wherein the lightweight Transformer encoder includes a first MHSA layer, a first Add&Norm layer, a first feedforward layer and a second Add&Norm layer connected in sequence, the input end of the first MHSA layer is also connected to the input end of the first Add&Norm layer, and the output end of the first Add&Norm layer is also connected to the input end of the second Add&Norm layer.

[0025] In a possible design, shallow fusion processing is performed on the image features and the API sequence features to obtain shallow fusion multimodal features, including:

[0026] Connecting the image features and the API sequence features to obtain multimodal sequence features;

[0027] A shallow fusion model is used to perform shallow fusion processing on the multimodal sequence features to obtain the initial fused multimodal features; wherein the shallow fusion model includes a second MHSA layer, a third Add&Norm layer, a second feedforward layer and a fourth Add&Norm layer connected in sequence, the input end of the second MHSA layer is also connected to the input end of the third Add&Norm layer, and the output end of the third Add&Norm layer is also connected to the input end of the fourth Add&Norm layer;

[0028] The first maximum pooling layer is used to perform feature selection on the initial fused multimodal features to obtain shallow fused multimodal features; wherein the first maximum pooling layer is connected to the output end of the fourth Add&Norm layer.

[0029] In a possible design, when deep fusion processing is performed on the image features and the API sequence features, a deep fusion model is adopted, and the deep fusion model includes a secondary text feature extraction model, a secondary image feature extraction model and a second maximum pooling layer; correspondingly, the image features and the API sequence features are deeply fused to obtain multimodal features after deep fusion, including:

[0030] The secondary text feature extraction model is used to extract features of the API sequence features again to obtain secondary API sequence features; wherein the secondary text feature extraction model includes a third MHSA layer, a fifth Add&Norm layer, a third feedforward layer and a sixth Add&Norm layer connected in sequence, the input end of the third MHSA layer is also connected to the input end of the fifth Add&Norm layer, the output end of the fifth Add&Norm layer is also connected to the input end of the sixth Add&Norm layer, and the output end of the sixth Add&Norm layer is connected to the second maximum pooling layer;

[0031] The image features are extracted again using the secondary image feature extraction model, and the secondary API sequence features are injected into the image features to obtain image guided features; wherein the secondary image feature extraction model includes a fourth MHSA layer, a seventh Add&Norm layer, an MHCA layer, an eighth Add&Norm layer, a fourth feedforward layer and a ninth Add&Norm layer connected in sequence, the output end of the sixth Add&Norm layer is connected to the input end of the MHCA layer, the input end of the fourth MHSA layer is connected to the input end of the seventh Add&Norm layer, the output end of the seventh Add&Norm layer is connected to the input end of the eighth Add&Norm layer, the output end of the eighth Add&Norm layer is connected to the input end of the ninth Add&Norm layer, and the output end of the ninth Add&Norm layer is connected to the second maximum pooling layer;

[0032] The second maximum pooling layer is used to perform feature selection from the secondary API sequence features and the image guided features to obtain multimodal features after deep fusion.

[0033] In a possible design, according to the shallow fusion multimodal features and the deep fusion multimodal features, a prototype network model is used to obtain the classification category of the malware to be classified, including:

[0034] Using a prototype network model to generate prototype features of the shallowly fused multimodal features and prototype features of the deeply fused multimodal features;

[0035] The classification category of the malware to be classified is obtained according to the prototype features of the shallowly fused multimodal features and the prototype features of the deeply fused multimodal features.

[0036] In a possible design, the prototype feature of the shallow fused multimodal feature or the deep fused multimodal feature is:

[0037] ;

[0038] Among them, S i is a feature of the shallow fused multimodal feature or the deep fused multimodal feature; S k is the feature set for malware classification category k.

[0039] In a second aspect, the present invention provides a malware classification system for implementing any one of the malware classification methods described above; the malware classification system comprises:

[0040] A feature extraction module, used to extract a binary byte sequence from an executable file of the malware to be classified, and perform image conversion on the binary byte sequence to obtain a grayscale image; used to perform API call analysis processing on the malware to be classified to obtain an API call sequence of the malware to be classified; and further used to perform feature extraction on the grayscale image and the API call sequence to obtain feature data of the malware to be classified; wherein the feature data includes image features corresponding to the grayscale image and API sequence features corresponding to the API call sequence;

[0041] A shallow fusion processing module, which is in communication with the feature extraction module and is used to perform shallow fusion processing on the image features and the API sequence features to obtain shallow fused multimodal features;

[0042] A deep fusion processing module, which is in communication with the feature extraction module and is used to perform deep fusion processing on the image features and the API sequence features to obtain multi-modal features after deep fusion;

[0043] The classification module is respectively communicated with the shallow fusion processing module and the deep fusion processing module, and is used to obtain the classification category of the malware to be classified by using the prototype network model according to the multimodal features after the shallow fusion and the multimodal features after the deep fusion.

[0044] In a third aspect, the present invention provides an electronic device, comprising:

[0045] a memory for storing computer program instructions; and,

[0046] A processor is used to execute the computer program instructions to complete the operation of any one of the malware classification methods described above.

[0047] In a fourth aspect, the present invention provides a computer program product, including a computer program or instructions, wherein the computer program or the instructions, when executed by a computer, implements any one of the malware classification methods described above.

[0048] The beneficial effects of the present invention are:

[0049] The present invention discloses a malware classification method, system, device and program product. By using a prototype network to realize the rapid classification of unknown malware in a small sample environment, the information in the limited sample can be fully mined to improve the accuracy of the classification of unknown malware. Specifically, in the implementation process of the present invention, two data modalities, image features corresponding to the binary grayscale image of the malware and API sequence features corresponding to the API call sequence during software runtime, are used as the basic data for malware classification for the first time, and shallow fusion processing and deep fusion processing are performed on the image features and the API sequence features to obtain shallow fusion multimodal features and deep fusion multimodal features. Finally, according to the shallow fusion multimodal features and the deep fusion multimodal features, the prototype network model is used to obtain the classification category of the malware to be classified, wherein the multimodal fusion technology can fuse different types of feature data, thereby enhancing the robustness and generalization ability of the subsequent malware classification, and by comprehensively utilizing the feature data including the image features corresponding to the grayscale image and the API sequence features corresponding to the API call sequence, it is convenient to more comprehensively describe the behavior and features of the malware, and improve the accuracy of the subsequent malware classification, so as to improve the classification accuracy while enhancing the effectiveness of malware classification.

[0050] Other beneficial effects of the present invention will be further described in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a flow chart of a form of the malware classification method in Example 1;

[0052] Figure 2 is a flowchart of another form of malware classification in Example 1;

[0053] Figure 3 It is a flowchart of using the CLIP-ResNet50 model to extract features from the enhanced grayscale image in Example 1, and using a lightweight Transformer encoder to extract features from the embedding matrix;

[0054] Figure 4 is a module block diagram of a malware classification system in Example 2;

[0055] Figure 5 This is a module block diagram of an electronic device in Example 3. DETAILED DESCRIPTION

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in combination with the drawings and the description of the embodiments or the prior art. Obviously, the following description of the structure of the drawings is only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0057] Embodiment 1:

[0058] This embodiment discloses a malware classification method, which can be executed by, but is not limited to, a computer device or a virtual machine with certain computing resources, such as a personal computer, a smart phone, a personal digital assistant, or a wearable device, or by a virtual machine.

[0059] like Figure 1 and Figure 2 As shown, a malware classification method may include but is not limited to the following steps:

[0060] S1. extracting a binary byte sequence from an executable file of the malware to be classified, and performing image conversion on the binary byte sequence to obtain a grayscale image; wherein each byte data in the binary byte sequence is used as a pixel point in the grayscale image, thereby constructing a grayscale image of the malware to be classified;

[0061] In this embodiment, visualized malware is considered an important source of information, and it is hoped that it can contribute to the final classification work together with the API call sequence. Specifically, in step S1, when converting the binary byte sequence into a grayscale image, each byte in the binary byte sequence of the malware to be classified is first converted into an integer range (i.e., [0,255]) to obtain a converted byte sequence; then, the last extra integer in the converted byte sequence is removed, and the sequence is reshaped into a two-dimensional square matrix; then, the two-dimensional square matrix is ​​converted into an initial grayscale image; finally, after a given image width (length) W that can be normally accepted by the neural network, the initial grayscale image is enlarged or reduced accordingly to obtain the final grayscale image. In the actual application of this embodiment, W is set to 256.

[0062] S2. Performing API (Application Programming Interface) call analysis and processing on the malware to be classified to obtain an API call sequence of the malware to be classified.

[0063] Generally speaking, malware is characterized by executable binary software. In order to obtain the features used to run the neural network from the malware, in this embodiment, it is converted into a token (smallest basic unit) level API sequence. Specifically, in step S2, the API call analysis and processing of the malware to be classified is performed to obtain the API call sequence of the malware to be classified, including:

[0064] S201. Execute the malware to be classified in a preset virtual environment to obtain an analysis report. In this embodiment, the malware to be classified may be executed but is not limited to using Cuckoo sandbox (an open source malware analysis system based on a virtualized environment written in Python) to analyze the dynamic behaviors of various file types and obtain an analysis report. It should be understood that the analysis report also includes parameters and return values ​​related to each API call, which have little effect on malware classification, so this embodiment ignores them. At the same time, since an API call sequence with a sequence length of less than 10 may indicate that the Cuckoo sandbox execution failed, this embodiment selectively retains only samples with a sequence length of not less than 10 in the analysis report.

[0065] S202. Considering that malware can start multiple processes at the same time, in order to make the API call sequence more linear, this embodiment connects the initial API call sequences of multiple processes in the analysis report to obtain a connected API call sequence;

[0066] S203. Preprocess the post-connection API call sequence to obtain a preprocessed API call sequence; specifically, this embodiment can use a shorter API call sequence consisting of two calls to replace a longer API call sequence in the post-connection API call sequence, in which the same API appears more than twice in a row, so as to refine the post-connection API call sequence and remove redundant features caused by repeated execution such as file loading or execution loops.

[0067] S204. Using an N-gram algorithm to process the preprocessed API call sequence to obtain a final API call sequence.

[0068] Specifically, in step S204, a sliding window operation of size N (N is a natural number greater than 0) is performed on the preprocessed API call sequence byte by byte, and the preprocessed API call sequence is filtered by a preset TF-IDF (Term Frequency-Inverse Document Frequency) value until the preprocessed API call sequence is traversed, thereby obtaining a final API call sequence, that is, an integer API N-gram sequence (also called API tokens), which can be embedded through an embedding matrix and output a corresponding token vector.

[0069] Among them, the N-gram algorithm is a basic algorithm widely used in text analysis and processing. It obtains the probability distribution information of each phrase in the text by counting the frequency of occurrence of a sequence of n consecutive words (or called "phrases") in the text.

[0070] S3. Perform feature extraction on the grayscale image and the API call sequence to obtain feature data of the malware to be classified; wherein the feature data includes image features corresponding to the grayscale image and API sequence features corresponding to the API call sequence.

[0071] In step S3, feature extraction is performed on the grayscale image and the API call sequence to obtain feature data of the malware to be classified, including:

[0072] S301. Perform image enhancement processing on the grayscale image to obtain an enhanced grayscale image; specifically, in this embodiment, the grayscale image is enhanced by using processes such as resizing, random cropping and random rotation.

[0073] S302. Use the CLIP-ResNet50 model based on text semantic perception to extract features of the enhanced grayscale image to obtain image features corresponding to the enhanced grayscale image; wherein the CLIP-ResNet50 model includes a first convolutional layer, a second convolutional layer, a third convolutional layer and a linear layer connected in sequence; specifically, the CLIP (full spelling: Contrastive Language-Image Pre-training) in the CLIP-ResNet50 model is a pre-training method based on contrasting text-image pairs, and the ResNet50 model is a deep residual network model based on a residual network, which can improve the learning ability and performance of the network.

[0074] In this embodiment, the first convolution layer, the second convolution layer and the third convolution layer are used to perform convolution processing on the enhanced grayscale image in sequence to extract features and fuse features of the enhanced grayscale image to obtain a feature map; the linear layer is used to perform linear processing on the feature map to obtain the final image features.

[0075] Specifically, in this embodiment, the enhanced grayscale image x I After convolution processing by the first convolution layer, the second convolution layer and the third convolution layer in sequence, its shape (channel, height, width) can be converted from (1024, 16, 16) to (16×16, 1024); in order to match the final image features with the API sequence features (text features), in this embodiment, the vector dimension of the feature map output from the third convolution layer is reduced to 512 through a linear layer. In this embodiment, the image feature is represented as I=f I (x I ), where f I (·) represents the process of CLIP-ResNet50 model performing feature extraction on the enhanced grayscale image.

[0076] S303. Based on a preset word dictionary, the API call sequence is word-embedded to obtain an embedding matrix, and a lightweight Transformer encoder is used to extract features from the embedding matrix to obtain API sequence features; wherein the lightweight Transformer encoder includes a first MHSA layer, a first Add&Norm layer, a first feedforward layer, and a second Add&Norm layer connected in sequence, the input end of the first MHSA layer is also connected to the input end of the first Add&Norm layer, and the output end of the first Add&Norm layer is also connected to the input end of the second Add&Norm layer. Specifically, in this embodiment, the MHSA (Multi-headed Self-attention) layer is implemented using a multi-headed self-attention mechanism, which includes multiple parallel self-attention layers, each of which can focus on different parts of the input and can capture multiple different characteristics of the input data at the same time; the Add&Norm (Residual Connection&Layer Normalization) layer can also be expressed as a residual connection and normalization layer.

[0077] In the implementation process of this embodiment, the word dictionary can be initialized and embedded through the GloVe (Global Vectors for Word Representation, an unsupervised learning algorithm for obtaining vector representations of words) algorithm, and the certificate API tokens in the API call sequence will be embedded in the matrix and further enter the first MHSA layer for feature extraction, and finally a 512-dimensional API sequence feature can be obtained. In this embodiment, the API sequence feature is represented as A=f A (x A ), where f A (·) represents the lightweight Transformer encoder’s API call sequence x A The process of feature extraction.

[0078] It should be noted that, in step S303 of this embodiment, word embedding processing is first performed on the API call sequence, which can help reduce the number of samples for subsequent training.

[0079] In this embodiment, Figure 3 As shown, (a) illustrates a flowchart of using the CLIP-ResNet50 model to extract features from the enhanced grayscale image; (b) illustrates a flowchart of using the lightweight Transformer encoder to extract features from the embedding matrix; the CLIP-ResNet50 model and the lightweight Transformer encoder constitute a feature extractor for extracting features from the grayscale image and the API call sequence, wherein the CLIP-ResNet50 model can be expressed as an image encoder, the CLIP-ResNet50 model can facilitate better fusion of image features, the lightweight Transformer encoder can be expressed as an API encoder, and the lightweight Transformer encoder can effectively alleviate the overfitting problem.

[0080] S4. Perform shallow fusion processing on the image features and the API sequence features to obtain shallow fused multimodal features.

[0081] In step S4, shallow fusion processing is performed on the image features and the API sequence features to obtain shallow fusion multimodal features, including:

[0082] S401. Connect the image feature and the API sequence feature to obtain a multimodal sequence feature. Specifically, in this embodiment, the image feature is represented as: I=[i1,i2,...,i N1 ]∈R N1×d , the API sequence feature is expressed as: A=[a1,a2,...,a N2 ]∈RN2×d , where N1 represents the length of the image feature, N2 represents the length of the API sequence feature, and d represents the length of each feature vector (image feature or API sequence feature). In this embodiment, it is set to 512. The multimodal sequence feature obtained by connecting the two can be expressed as S=[i1,...,i N1 ,a1,...,a N2 ]∈R (N1+N2)×d It should be noted that, in this embodiment, due to the connection operation performed at the input stage of the shallow fusion model, the visual and textual modalities contribute equally to the final malware classification.

[0083] S402. Perform shallow fusion processing on the multimodal sequence features using a shallow fusion model to obtain an initial fused multimodal feature; wherein the shallow fusion model includes a second MHSA layer, a third Add&Norm layer, a second feedforward layer, and a fourth Add&Norm layer connected in sequence, the input end of the second MHSA layer is also connected to the input end of the third Add&Norm layer, and the output end of the third Add&Norm layer is also connected to the input end of the fourth Add&Norm layer; in this embodiment, the initial fused multimodal feature F can be obtained after processing by the second MHSA layer shallow ∈R （N1+N2）×d .

[0084] In step S402, the attention mask of the second MHSA layer is used to control whether a token can notice other tokens, so as to prevent the visual token or text token in the multimodal sequence feature from noticing the filler token. (N1+N2)×(N1+N2) is defined as follows:

[0085] ;

[0086] In practice, only the text part of the multimodal sequence features, i.e., the API sequence features, is considered by padding some API sequence features to a predefined length and using the padded API sequence features for batch training (inference), while all visual corresponding parts, i.e., image features, are set to 0.

[0087] In the case of input multimodal sequence features S and attention mask M, the processing process of the second MHSA layer on the multimodal sequence features S can be described as follows:

[0088] ;

[0089] Among them, W i Q ∈R d×dq, W i K ∈R d×dk and W i V ∈R d×dv is a preset parameter matrix; h is the number of self-attention heads in the second MHSA layer. In this embodiment, h is set to 2; Q, K, and V are usually obtained by multiplying the input data (multimodal sequence features S) by a preset weight matrix, which is also the parameter that the model needs to learn.

[0090] S403. Use the first maximum pooling layer to perform feature selection on the initial fused multimodal features to obtain shallow fused multimodal features; wherein the first maximum pooling layer is connected to the output end of the fourth Add&Norm layer. shallow ∈R （N1+N2）×d By performing feature selection through the first maximum pooling layer, the final shallow fusion multimodal feature s can be obtained. shallow =Max-Pooling(F shallow ).

[0091] S5. Perform deep fusion processing on the image features and the API sequence features to obtain multimodal features after deep fusion.

[0092] In step S5, when the image features and the API sequence features are deeply fused, a deep fusion model is used, such as Figure 3 As shown, the deep fusion model includes a secondary text feature extraction model, a secondary image feature extraction model and a second maximum pooling layer; correspondingly, the image features and the API sequence features are deeply fused to obtain multimodal features after deep fusion, including:

[0093] S501. Use the secondary text feature extraction model to extract features of the API sequence features again to obtain secondary API sequence features; wherein the secondary text feature extraction model includes a third MHSA layer, a fifth Add&Norm layer, a third feedforward layer and a sixth Add&Norm layer connected in sequence, the input end of the third MHSA layer is also connected to the input end of the fifth Add&Norm layer, the output end of the fifth Add&Norm layer is also connected to the input end of the sixth Add&Norm layer, and the output end of the sixth Add&Norm layer is connected to the second maximum pooling layer;

[0094] S502. Use the secondary image feature extraction model to extract features from the image features again, and inject the secondary API sequence features into the image features to obtain image guidance features; wherein the secondary image feature extraction model includes a fourth MHSA layer, a seventh Add&Norm layer, an MHCA layer, an eighth Add&Norm layer, a fourth feedforward layer and a ninth Add&Norm layer connected in sequence, the output end of the sixth Add&Norm layer is connected to the input end of the MHCA layer, the input end of the fourth MHSA layer is connected to the input end of the seventh Add&Norm layer, and the output end of the seventh Add&Norm layer is connected to the input end of the seventh Add&Norm layer. The input end of the eighth Add&Norm layer is connected, the output end of the eighth Add&Norm layer is connected to the input end of the ninth Add&Norm layer, and the output end of the ninth Add&Norm layer is connected to the second maximum pooling layer; specifically, in step S502 of this embodiment, the image feature can be first input into the fourth MHSA layer of the secondary image feature extraction model, and then input into the seventh Add&Norm layer to obtain the secondary image feature; then, the secondary image feature is injected into the secondary API sequence feature through the MHCA (multi-head cross attention) layer to obtain the image guided feature G=[g1,g2,...,g N1 ]. In this process, the secondary image feature is represented as I, and the secondary API sequence feature is represented as A. The process of the MHCA layer processing the secondary image feature I and the secondary API sequence feature A is as follows:

[0095] ;

[0096] Among them, W i Q ∈R d×dq , W i K ∈R d×dk and W i V ∈R d×dv is the preset parameter matrix, and h is the number of self-attention heads in the MHCA layer. Compared with the MSHA layer, the MHCA layer has a similar architecture, but after the last fourth feedforward layer and nine Add&Norm layers, the image-guided API features can be obtained, that is, the image-guided features G=[g1,g2,...,g N1 ].

[0097] S503. Use the second maximum pooling layer to select features from the secondary API sequence features and the image guidance features to obtain multi-modal features after deep fusion. Specifically, the multi-modal features after deep fusion can be expressed as: deep=Max-Pooling(concat(G,A)).

[0098] In this embodiment, the shallow fusion model and the deep fusion model are collectively referred to as a multimodal feature fusion model.

[0099] S6. According to the multimodal features after shallow fusion and the multimodal features after deep fusion, the prototype network model is used to obtain the classification category of the malware to be classified. It should be noted that the prototype network model adopts a simple and efficient small sample learning method, which can avoid the pre-collection of a large number of samples for training. At the same time, the multimodal fused feature data is used as the basic data for malware classification, which can avoid the problem of overfitting or underfitting in the case of small samples, which is conducive to improving the accuracy of malware classification in this embodiment.

[0100] Specifically, in step S6, according to the shallow fusion multimodal features and the deep fusion multimodal features, a prototype network model is used to obtain the classification category of the malware to be classified, including:

[0101] S601. Using a prototype network model to generate the prototype features of the shallow fusion multimodal features and the prototype features of the deep fusion multimodal features;

[0102] S602. Obtain the classification category of the malware to be classified according to the prototype features of the shallowly fused multimodal features and the prototype features of the deeply fused multimodal features.

[0103] In this embodiment, the prototype features of the shallow fusion multimodal features or the deep fusion multimodal features are:

[0104] ;

[0105] Among them, S i is a feature of the shallow fused multimodal feature or the deep fused multimodal feature; S k is the feature set for malware classification category k.

[0106] In step S601 of this embodiment, after obtaining the prototype features of the shallow fused multimodal features and the prototype features of the deep fused multimodal features, a query vector s is extracted from the shallow fused multimodal features and the deep fused multimodal features. q , which is used to compare with the category prototype features determined by the training set, so as to classify the malware to be classified. In this embodiment, the query vector s q Calculate the corresponding probability for each category:

[0107] ;

[0108] Where d is the preset distance function.

[0109] Finally, the software classification category with the highest probability is used as the final classification category of the malware to be classified.

[0110] It should be understood that, in this embodiment, step S1 and step S2 are executed in parallel, step S4 and step S5 are executed in parallel, and the outputs of step S1 and step S2 constitute the input of step S3, the output of step S3 constitutes the input of step S4 and step S5, and the outputs of step S4 and step S5 constitute the input of step S6. Figure 1 In order to clearly show the contents of each step, a simplified sequential description is used.

[0111] This embodiment uses a prototype network to achieve rapid classification of unknown malware in a small sample environment, which can fully mine the information in a limited sample and improve the accuracy of classifying unknown malware. Specifically, during the implementation of this embodiment, two data modalities, image features corresponding to the binary grayscale image of the malware and API sequence features corresponding to the API call sequence during software runtime, are used as basic data for malware classification for the first time, and shallow fusion processing and deep fusion processing are performed on the image features and the API sequence features to obtain shallow fusion multimodal features and deep fusion multimodal features. Finally, according to the shallow fusion multimodal features and the deep fusion multimodal features, the prototype network model is used to obtain the classification category of the malware to be classified, wherein the multimodal fusion technology can fuse different types of feature data, thereby enhancing the robustness and generalization ability of subsequent malware classification, and by comprehensively utilizing the feature data including the image features corresponding to the grayscale image and the API sequence features corresponding to the API call sequence, it is convenient to more comprehensively describe the behavior and features of the malware, and improve the accuracy of subsequent malware classification, thereby improving the classification accuracy while enhancing the effectiveness of malware classification.

[0112] Embodiment 2:

[0113] This embodiment discloses a malware classification system for implementing the malware classification method in Embodiment 1; Figure 4 As shown, the malware classification system includes:

[0114] A feature extraction module, used to extract a binary byte sequence from an executable file of the malware to be classified, and perform image conversion on the binary byte sequence to obtain a grayscale image; used to perform API call analysis processing on the malware to be classified to obtain an API call sequence of the malware to be classified; and further used to perform feature extraction on the grayscale image and the API call sequence to obtain feature data of the malware to be classified; wherein the feature data includes image features corresponding to the grayscale image and API sequence features corresponding to the API call sequence;

[0115] A shallow fusion processing module, which is in communication with the feature extraction module and is used to perform shallow fusion processing on the image features and the API sequence features to obtain shallow fused multimodal features;

[0116] A deep fusion processing module, which is in communication with the feature extraction module and is used to perform deep fusion processing on the image features and the API sequence features to obtain multi-modal features after deep fusion;

[0117] The classification module is respectively communicated with the shallow fusion processing module and the deep fusion processing module, and is used to obtain the classification category of the malware to be classified by using the prototype network model according to the multimodal features after the shallow fusion and the multimodal features after the deep fusion.

[0118] It should be noted that the working process, working details and technical effects of the malware classification system provided in this embodiment 2 can be found in embodiment 1 and will not be described in detail here.

[0119] Embodiment 3:

[0120] Based on Embodiment 1 or 2, this embodiment discloses an electronic device, which may be a smart phone, a tablet computer, a laptop computer, or a desktop computer. The electronic device may be referred to as a user terminal, a portable terminal, a desktop terminal, etc. Figure 5 As shown, the electronic equipment includes:

[0121] a memory for storing computer program instructions; and,

[0122] A processor is used to execute the computer program instructions to complete the operation of the malware classification method as described in any one of Example 1.

[0123] Specifically, the processor 301 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 301 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 301 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 301 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen.

[0124] The memory 302 may include one or more computer-readable storage media, which may be non-transitory. The memory 302 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 302 is used to store at least one instruction, which is used to be executed by the processor 301 to implement the malware classification method provided in Example 1 of the present application.

[0125] In some embodiments, the terminal may further optionally include: a communication interface 303 and at least one peripheral device. The processor 301, the memory 302 and the communication interface 303 may be connected via a bus or a signal line. Each peripheral device may be connected to the communication interface 303 via a bus, a signal line or a circuit board. Specifically, the peripheral device includes: at least one of a radio frequency circuit 304, a display screen 305 and a power supply 306.

[0126] The communication interface 303 may be used to connect at least one peripheral device related to I / O (Input / Output) to the processor 301 and the memory 302. In some embodiments, the processor 301, the memory 302, and the communication interface 303 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 301, the memory 302, and the communication interface 303 may be implemented on a separate chip or circuit board, which is not limited in this embodiment.

[0127] The radio frequency circuit 304 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 304 communicates with a communication network and other communication devices through electromagnetic signals.

[0128] The display screen 305 is used to display a UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof.

[0129] The power supply 306 is used to supply power to various components in the electronic device.

[0130] Embodiment 4:

[0131] Based on any one of Embodiments 1 to 3, this embodiment discloses a computer program product, including a computer program or instructions, which implement the malware classification method as described in any one of Embodiments 1 when executed by a computer.

[0132] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the above embodiments, a person skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A malware classification method, characterized by: include: Extracting a binary byte sequence from an executable file of the malware to be classified, and performing image conversion on the binary byte sequence to obtain a grayscale image; Performing API call analysis and processing on the malware to be classified to obtain an API call sequence of the malware to be classified; Performing feature extraction on the grayscale image and the API call sequence to obtain feature data of the malware to be classified; wherein the feature data includes image features corresponding to the grayscale image and API sequence features corresponding to the API call sequence; Performing shallow fusion processing on the image features and the API sequence features to obtain shallow fused multimodal features; Performing deep fusion processing on the image features and the API sequence features to obtain multimodal features after deep fusion; According to the shallowly fused multimodal features and the deeply fused multimodal features, a prototype network model is used to obtain the classification category of the malware to be classified.

2. A malware classification method according to claim 1, characterized in that: Performing API call analysis and processing on the malware to be classified to obtain an API call sequence of the malware to be classified, including: Executing the malware to be classified in a preset virtual environment to obtain an analysis report; Connecting the initial API call sequences of the multiple processes in the analysis report to obtain a connected API call sequence; Preprocessing the post-connection API call sequence to obtain a preprocessed API call sequence; The pre-processed API call sequence is processed using an N-gram algorithm to obtain a final API call sequence.

3. A malware classification method according to claim 1, characterized in that: Performing feature extraction on the grayscale image and the API call sequence to obtain feature data of the malware to be classified includes: Performing image enhancement processing on the grayscale image to obtain an enhanced grayscale image; Using a text semantic perception-based CLIP-ResNet50 model to extract features from the enhanced grayscale image to obtain image features corresponding to the enhanced grayscale image; wherein the CLIP-ResNet50 model includes a first convolutional layer, a second convolutional layer, a third convolutional layer and a linear layer connected in sequence; Based on a preset word dictionary, the API call sequence is word embedded to obtain an embedding matrix, and a lightweight Transformer encoder is used to extract features from the embedding matrix to obtain API sequence features; wherein the lightweight Transformer encoder includes a first MHSA layer, a first Add&Norm layer, a first feedforward layer and a second Add&Norm layer connected in sequence, the input end of the first MHSA layer is also connected to the input end of the first Add&Norm layer, and the output end of the first Add&Norm layer is also connected to the input end of the second Add&Norm layer.

4. A malware classification method according to claim 1, characterized in that: The image features and the API sequence features are shallowly fused to obtain shallowly fused multimodal features, including: Connecting the image features and the API sequence features to obtain multimodal sequence features; A shallow fusion model is used to perform shallow fusion processing on the multimodal sequence features to obtain the initial fused multimodal features; wherein the shallow fusion model includes a second MHSA layer, a third Add&Norm layer, a second feedforward layer and a fourth Add&Norm layer connected in sequence, the input end of the second MHSA layer is also connected to the input end of the third Add&Norm layer, and the output end of the third Add&Norm layer is also connected to the input end of the fourth Add&Norm layer; The first maximum pooling layer is used to perform feature selection on the initial fused multimodal features to obtain shallow fused multimodal features; wherein the first maximum pooling layer is connected to the output end of the fourth Add&Norm layer.

5. A malware classification method according to claim 1, characterized in that: When the image features and the API sequence features are deeply fused, a deep fusion model is used, and the deep fusion model includes a secondary text feature extraction model, a secondary image feature extraction model and a second maximum pooling layer; correspondingly, the image features and the API sequence features are deeply fused to obtain multimodal features after deep fusion, including: The secondary text feature extraction model is used to extract features of the API sequence features again to obtain secondary API sequence features; wherein the secondary text feature extraction model includes a third MHSA layer, a fifth Add&Norm layer, a third feedforward layer and a sixth Add&Norm layer connected in sequence, the input end of the third MHSA layer is also connected to the input end of the fifth Add&Norm layer, the output end of the fifth Add&Norm layer is also connected to the input end of the sixth Add&Norm layer, and the output end of the sixth Add&Norm layer is connected to the second maximum pooling layer; The image features are extracted again using the secondary image feature extraction model, and the secondary API sequence features are injected into the image features to obtain image guided features; wherein the secondary image feature extraction model includes a fourth MHSA layer, a seventh Add&Norm layer, an MHCA layer, an eighth Add&Norm layer, a fourth feedforward layer and a ninth Add&Norm layer connected in sequence, the output end of the sixth Add&Norm layer is connected to the input end of the MHCA layer, the input end of the fourth MHSA layer is connected to the input end of the seventh Add&Norm layer, the output end of the seventh Add&Norm layer is connected to the input end of the eighth Add&Norm layer, the output end of the eighth Add&Norm layer is connected to the input end of the ninth Add&Norm layer, and the output end of the ninth Add&Norm layer is connected to the second maximum pooling layer; The second maximum pooling layer is used to perform feature selection from the secondary API sequence features and the image guided features to obtain multimodal features after deep fusion.

6. A malware classification method according to claim 1, characterized in that: According to the shallow fusion multimodal features and the deep fusion multimodal features, a prototype network model is used to obtain the classification category of the malware to be classified, including: Using a prototype network model to generate prototype features of the shallowly fused multimodal features and prototype features of the deeply fused multimodal features; The classification category of the malware to be classified is obtained according to the prototype features of the shallowly fused multimodal features and the prototype features of the deeply fused multimodal features.

7. A malware classification method according to claim 6, characterized in that: The prototype features of the shallow fused multimodal features or the deep fused multimodal features are: ； Among them, S i is a feature of the shallow fused multimodal feature or the deep fused multimodal feature; S k is the feature set for malware classification category k.

8. A malware classification system, characterized by: Used to implement the malware classification method according to any one of claims 1 to 7; the malware classification system comprises: A feature extraction module, used to extract a binary byte sequence from an executable file of the malware to be classified, and perform image conversion on the binary byte sequence to obtain a grayscale image; used to perform API call analysis processing on the malware to be classified to obtain an API call sequence of the malware to be classified; and further used to perform feature extraction on the grayscale image and the API call sequence to obtain feature data of the malware to be classified; wherein the feature data includes image features corresponding to the grayscale image and API sequence features corresponding to the API call sequence; A shallow fusion processing module, which is in communication with the feature extraction module and is used to perform shallow fusion processing on the image features and the API sequence features to obtain shallow fused multimodal features; A deep fusion processing module, which is in communication with the feature extraction module and is used to perform deep fusion processing on the image features and the API sequence features to obtain multi-modal features after deep fusion; The classification module is respectively communicated with the shallow fusion processing module and the deep fusion processing module, and is used to obtain the classification category of the malware to be classified by using the prototype network model according to the multimodal features after the shallow fusion and the multimodal features after the deep fusion.

9. An electronic device, characterized in that: include: a memory for storing computer program instructions; as well as, A processor, configured to execute the computer program instructions to complete the operation of the malware classification method as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program or instructions, characterized in that: When the computer program or the instruction is executed by a computer, the malware classification method according to any one of claims 1 to 7 is implemented.

Images