A model training method, equipment and device

Abstract

The present application relates to the field of network security, and in particular to a model training method, device and apparatus. In an embodiment of the present application, a training sample set is obtained, which includes multiple sample programs and multiple multimodal samples corresponding to each of the multiple sample programs; a malicious program detection model to be trained is iteratively trained based on the training sample set to obtain a trained malicious program detection model, wherein in each round of iterative training, the following operations are performed: for each sample program in the training sample set, the following operations are performed respectively: based on the first similarity between the multiple multimodal samples corresponding to the sample program, and the second similarity between the multiple multimodal samples corresponding to the sample program and other multimodal samples in the training sample set, the alignment loss value of the sample program is determined; based on the alignment loss value of each sample program in the training sample set, the malicious program detection model is adjusted.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a model training method, equipment and device. Background Art

[0002] With the rapid development of information technology, malicious programs (such as viruses, Trojans, worms, and ransomware) have become the main threats in modern computing environments. For example, malicious programs can cause user data leakage, privacy infringement, system paralysis, and network infection.

[0003] However, malware detection is not an easy task. With the continuous evolution of attack techniques, malware has become more and more complex, and has adopted a variety of strategies to evade detection. For example, some malware will disguise themselves, which is difficult to be identified by traditional detection methods and can be easily bypassed by attackers, thus affecting the effectiveness and reliability of detection.

[0004] Therefore, developing and optimizing malware detection techniques to address these challenges is an ongoing task in the field of cybersecurity. Summary of the invention

[0005] The present application provides a model training method, equipment and device to solve the problem in the prior art that malicious programs may be disguised and difficult to be identified.

[0006] In a first aspect, the present application provides a model training method, the method comprising:

[0007] Acquire a training sample set, wherein the training sample set includes a plurality of sample programs and a plurality of multimodal samples corresponding to each of the plurality of sample programs; wherein the plurality of multimodal samples corresponding to each sample program respectively represent information of different modal types;

[0008] Iteratively train the malicious program detection model to be trained based on the training sample set to obtain a trained malicious program detection model, wherein in each round of iterative training, the following operations are performed:

[0009] For each sample program in the training sample set, respectively perform the following operations: determine an alignment loss value of the sample program based on a first similarity between a plurality of multimodal samples corresponding to the sample program and a second similarity between each of the plurality of multimodal samples corresponding to the sample program and other multimodal samples in the training sample set;

[0010] Based on the alignment loss value of each sample program in the training sample set, the malicious program detection model is adjusted.

[0011] The above scheme, after obtaining the sample program and multiple multimodal samples corresponding to each sample program, combines the information of the multimodal samples of different modal types, aligns the information of the multimodal samples of different modal types in the semantic space, and ensures the semantic consistency of the information of different modal types in the semantic space, so that malicious programs can be identified in the information of multiple modal types, and the consistency of the information of multiple modal types is ensured, thereby improving the accuracy and robustness of the malicious program detection model.

[0012] In some optional implementations, the plurality of multimodal samples include text modality samples, image modality samples, and code modality samples;

[0013] The text modality samples are used to represent machine language type information, the image modality samples are used to represent visual type information, and the code modality samples are used to represent code logic type information.

[0014] In some optional implementations, determining the alignment loss value of the sample program based on a first similarity between the multiple multimodal samples corresponding to the sample program and a second similarity between each of the multiple multimodal samples corresponding to the sample program and other multimodal samples in the training sample set includes:

[0015] respectively determining modal vectors of a plurality of multimodal samples corresponding to the sample program;

[0016] For each multimodal sample corresponding to the sample program, the following operations are performed respectively: based on the modal vector of the multimodal sample and other modal vectors corresponding to the sample program, a first similarity between the multimodal sample and other multimodal samples corresponding to the sample program is determined; based on the modal vector of the multimodal sample and the modal vectors corresponding to other sample programs in the training sample set, a second similarity between the multimodal sample and multimodal samples corresponding to other sample programs is determined; based on the first similarity between the multimodal sample and other multimodal samples corresponding to the sample program, and the second similarity between the multimodal sample and multimodal samples corresponding to other sample programs, an alignment loss value of the multimodal sample is determined;

[0017] Based on the alignment loss values ​​of a plurality of multimodal samples corresponding to the sample program, an alignment loss value corresponding to the sample program is determined.

[0018] In some optional implementations, determining the alignment loss value corresponding to the sample program based on the alignment loss value corresponding to each multimodal sample corresponding to the sample program includes:

[0019] The average of the alignment loss values ​​of the multiple multimodal samples corresponding to the sample program is used as the alignment loss value of the sample program.

[0020] In some optional implementations, each sample program in the training sample set has a training label, and adjusting the parameters of the malicious program detection model based on the alignment loss value of each sample program in the training sample set includes:

[0021] For each sample program in the training sample set, based on a plurality of multimodal samples corresponding to the sample program, determine a predicted label of the sample program, and based on the predicted label of the sample program and the training label, determine a label loss value corresponding to the sample program;

[0022] Determine a total loss value based on the alignment loss value and the label loss value of each sample program in the training sample set;

[0023] The malicious program detection model is adjusted based on the total loss value.

[0024] In some optional implementations, determining the predicted label of the sample program based on the multiple multimodal samples corresponding to the sample program includes:

[0025] Splicing a plurality of modal vectors corresponding to the sample program to determine a modal splicing vector corresponding to the sample program; the plurality of modal vectors are respectively determined according to a plurality of multimodal samples corresponding to the sample program;

[0026] Based on the modal splicing vector corresponding to the sample program, a prediction label corresponding to the sample program is determined.

[0027] In a second aspect, an embodiment of the present application provides a model training device, the device comprising:

[0028] An acquisition module is used to acquire a training sample set, wherein the sample set includes a plurality of sample programs and a plurality of multimodal samples corresponding to each of the plurality of sample programs; wherein the plurality of multimodal samples corresponding to each sample program respectively represent information of different modal types;

[0029] A training module is used to iteratively train a malicious program detection model to be trained based on the training sample set to obtain a trained malicious program detection model, wherein in each round of iterative training, the following operations are performed: for each sample program in the training sample set, the following operations are performed respectively: based on a first similarity between multiple multimodal samples corresponding to the sample program, and a second similarity between each of the multiple multimodal samples corresponding to the sample program and other multimodal samples in the training sample set, an alignment loss value of the sample program is determined; based on the alignment loss value of each sample program in the training sample set, the malicious program detection model is adjusted.

[0030] In a third aspect, an embodiment of the present application provides an electronic device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the steps of any method described in the first aspect above.

[0031] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a processor, wherein when the program runs on the processor, the processor executes the steps of any of the methods described in the first aspect.

[0032] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, wherein the computer program is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs the steps of any method described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0034] Figure 1 A flowchart of a model training method provided in an embodiment of the present application;

[0035] Figure 2 A flowchart for determining an alignment loss value of a sample program provided in an embodiment of the present application;

[0036] Figure 3 A schematic diagram of determining a modal vector of a multimodal sample provided in an embodiment of the present application;

[0037] Figure 4 A schematic diagram of determining an alignment loss value provided in an embodiment of the present application;

[0038] Figure 5 A flowchart for adjusting parameters of a malicious program detection model provided in an embodiment of the present application;

[0039] Figure 6 A flowchart for determining a prediction label provided in an embodiment of the present application;

[0040] Figure 7 A schematic diagram of determining a label loss value provided in an embodiment of the present application;

[0041] Figure 8 A schematic diagram of determining an alignment loss value and a label loss value provided in an embodiment of the present application;

[0042] Fig. 9 An overall schematic diagram of a training malicious detection model provided in an embodiment of the present application;

[0043] Fig.10 A schematic diagram of a model training device provided in an embodiment of the present application;

[0044] Fig.11 An electronic device provided in an embodiment of the present application;

[0045] Fig.12 An electronic device is provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Among them, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0047] Furthermore, in the description of the embodiments of the present application, unless otherwise specified, “and” means or. For example, A / B can mean A or B. The “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0048] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0049] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be directly connected, or indirectly connected through an intermediate medium, or it can be the internal connection of two devices. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0050] In order to facilitate understanding of the method, device, and electronic device for obtaining user information by a microservice provided in an embodiment of the present application, some terms in the embodiment of the present application are explained below to facilitate understanding by those skilled in the art.

[0051] Multimodal Contrastive Learning (MML) is a contrastive learning method that combines multiple data modalities.

[0052] TextCNN is a CNN model for text classification. It extracts text features through word embedding, convolutional layer, pooling layer, fully connected layer and other structures. It is often used for short text classification, such as news and comment classification. Its advantage lies in efficient feature extraction and calculation.

[0053] ResNet (Residual Network) is a deep neural network architecture widely used in computer vision tasks, especially image classification.

[0054] InfoNCEloss is a loss function for self-supervised learning that helps the model learn effective feature representations by maximizing the similarity between positive samples and minimizing the similarity between negative samples. It is widely used in contrastive learning tasks and has an adjustable temperature coefficient to control the model's discrimination of samples.

[0055] Cross Entropy Loss is a loss function suitable for classification tasks that measures the difference between the model's predicted structure and the true label.

[0056] The following is a brief introduction to the design concept of the embodiment of the present application:

[0057] With the rapid development of information technology, malicious programs (such as viruses, Trojans, worms, and ransomware) have become the main threats in modern computing environments. For example, malicious programs can cause user data leakage, privacy infringement, system paralysis, and network infection.

[0058] However, malware detection is not an easy task. With the continuous evolution of attack techniques, malware has become more and more complex, and has adopted a variety of strategies to evade detection. For example, some malware will disguise themselves, which is difficult to be identified by traditional detection methods and can be easily bypassed by attackers, thus affecting the effectiveness and reliability of detection.

[0059] Therefore, developing and optimizing malware detection techniques to address these challenges is an ongoing task in the field of cybersecurity.

[0060] Based on this, after obtaining the sample program and multiple multimodal samples corresponding to each sample program, the embodiment of the present application combines the information of the multimodal samples of different modal types, aligns the information of the multimodal samples of different modal types in the semantic space, and ensures the semantic consistency of the information of different modal types in the semantic space, so that malicious programs can be identified in the information of multiple modal types, and the consistency of the information of multiple modal types can be ensured, thereby improving the accuracy and robustness of the malicious program detection model.

[0061] In order to make the purpose, technical solution and beneficial effects of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0062] The trained malicious program detection model in the embodiment of the present application can be applied to electronic devices, which may be personal computers, mobile phones, tablet computers, notebooks, intelligent voice interaction devices, smart home devices, and other computer devices with certain computing capabilities.

[0063] In the embodiment of the present application, the malware detection model can be trained on a server or an electronic device. If the training is performed on an electronic device, the electronic device used for training can be the same as or different from the electronic device to which the trained malware detection model is applied, and the present application does not limit this.

[0064] like Figure 1 As shown, a flow chart of a model training method in an embodiment of the present application, the specific steps are as follows:

[0065] Step S101: obtaining a training sample set, wherein the training sample set includes a plurality of sample programs and a plurality of multimodal samples corresponding to each of the plurality of sample programs.

[0066] Among them, the multiple multimodal samples corresponding to each sample program respectively represent information of different modal types.

[0067] Exemplarily, in the embodiment of the present application, the multiple multimodal samples include text modal samples, image modal samples and code modal samples. The text modal samples are used to represent information of machine language type, the image modal samples are used to represent information of visual type, and the code modal samples are used to represent information of code logic type.

[0068] Optionally, an embodiment of the present application converts each sample program in the training sample set into a bit sequence corresponding to the corresponding sample program, and converts the bit sequence corresponding to each sample program into multiple modal samples.

[0069] Among them, the embodiment of the present application can retain the first 2000 bits after converting the sample program into a bit sequence form.

[0070] In an optional implementation, for each sample program in the training sample set, the bit sequence corresponding to the sample program is read based on hexadecimal to obtain the text modality sample corresponding to the sample program, that is, the text modality sample is equivalent to the hexadecimal sequence sample. The text modality sample is used to represent the information of the machine language type.

[0071] In an optional implementation, for each sample program in the training sample set, the bit sequence corresponding to the sample program is converted into an image format to obtain an image modality sample corresponding to the sample program. The image mode sample may be a sample of a grayscale image. The image modality sample is used to characterize visual type information.

[0072] In an optional implementation, for each sample program in the training sample set, the bit sequence corresponding to the sample program is converted into a code modality sample, which is equivalent to an instruction sequence of an assembly language. The code modality sample is used to characterize information about the logic type of the code.

[0073] Step S102, iteratively training the malicious program detection model to be trained based on the training sample set to obtain a trained malicious program detection model, wherein in each round of iterative training, the following operations are performed:

[0074] Step S1021, for each sample program in the training sample set, perform the following operations respectively: based on the first similarity between multiple multimodal samples corresponding to the sample program, and the second similarity between each of the multiple multimodal samples corresponding to the sample program and other multimodal samples in the training sample set, determine the alignment loss value of the sample program.

[0075] Among them, among the multiple multimodal samples corresponding to a sample program, a first similarity between every two multimodal samples is determined.

[0076] Optional, such as Figure 2 As shown, a flowchart of determining the alignment loss value of a sample program in an embodiment of the present application, the specific steps are as follows:

[0077] Step S201 , respectively determining the modal vectors of a plurality of multimodal samples corresponding to the sample program.

[0078] The method for determining the modal vectors of multiple multimodal samples corresponding to each sample program in the training sample set in the embodiment of the present application is the same.

[0079] Optionally, the embodiment of the present application trains multiple independent models based on multimodal samples of the sample program in the training sample set, and determines the modal vector of each multimodal sample through the multiple models.

[0080] Exemplarily, for text modal samples and code modal samples, the embodiments of the present application may use a TextCNN model. That is, a first TextCNN model is trained based on text modal samples, and the modal vector of the text modal sample is determined based on the trained first TextCNN model. A second TextCNN model is trained based on code modal samples, and the modal vector of the code modal sample is determined based on the trained second TextCNN model. For image modal samples, the embodiments of the present application may use a resnet model. That is, a resnet model is trained based on image modal samples, and the modal vector of the image modal sample is determined based on the trained resnet model.

[0081] The following describes the usage of the TextCNN model in this embodiment:

[0082] The first layer of the TextCNN model is the encoding layer, which is used to convert multimodal samples into 1*4 vectors. The encoding layer only encodes sequences of length N, so the dimension of the encoding layer is N*4.

[0083] The second layer of the TextCNN model is the convolutional layer, which is used to extract sequence features. The convolution kernel sizes are 2, 3, and 4, respectively, and each convolution kernel contains 100 convolution operations.

[0084] The third layer of the TextCNN model is the pooling layer, which is used to convert the data into scalars through maximum pooling. The pooling results of 300 convolution operations are then concatenated to obtain the modal vectors of the corresponding multimodal samples.

[0085] The fourth layer of the TextCNN model is a fully connected layer, and the output is the classification result of sequence samples.

[0086] It should be noted that after the TextCNN model training is completed, the embodiment of the present application obtains the modal vector of the multimodal samples obtained in the third layer.

[0087] Among them, the embodiment of the present application introduces the process of using the resnet model to determine the modal vector of the corresponding multimodal sample as follows: the image modal sample is encoded using the resnet model to obtain the modal vector of the image modal sample, which is also a feature vector, and the length of the feature vector is 512. The third layer of the resnet model is the output layer, the input is the feature vector of the sample program, and the output is the classification result of the sequence sample.

[0088] It should be noted that after the resnet model training is completed, the embodiment of the present application obtains the modal vector of the image modal sample.

[0089] like Figure 3 As shown, a schematic diagram of determining the modal vector of a multimodal sample in an embodiment of the present application. In which, the sample program is converted into a bit sequence, and the bit sequence is converted into a text modal sample, an image modal sample and a code modal sample respectively, and the generated text modal sample and code modal sample are respectively input into the TextCNN model to obtain the corresponding feature vector, and the generated image modal sample is input into the resnet model to obtain the corresponding feature vector.

[0090] The embodiment of the present application trains a malware detection model based on the modal vectors of multiple multimodal samples in the training sample set and the three trained models, wherein the malware detection model may be MMLMD, and contrastive learning is used to achieve semantic vector alignment between modalities.

[0091] Among them, MMLMD stands for multimodal contrastive learning malware detection, where MML stands for (MultimodalContrastive Learning) and MD stands for (Malware Detection).

[0092] Step S202, for each multimodal sample corresponding to the sample program, perform the following operations respectively: based on the modal vector of the multimodal sample and other modal vectors corresponding to the sample program, determine the first similarity between the multimodal sample and other multimodal samples corresponding to the sample program; based on the modal vector of the multimodal sample and the modal vectors corresponding to other sample programs in the training sample set, determine the second similarity between the multimodal sample and multimodal samples corresponding to other sample programs; based on the first similarity between the multimodal sample and other multimodal samples corresponding to the sample program, and the second similarity between the multimodal sample and multimodal samples corresponding to other sample programs, determine the alignment loss value of the multimodal sample.

[0093] In the embodiment of the present application, the modal vector of the multimodal sample (called an anchor) and the modal vectors of other multimodal samples of the same sample program constitute a positive sample pair (i.e., k+), and the modal vectors of multimodal samples of other sample programs in the training sample set constitute a negative sample pair (i.e., k-).

[0094] Optionally, the embodiment of the present application may use the InfoNCE Loss function to calculate the alignment loss value.

[0095] like Figure 4 As shown, a schematic diagram of determining an alignment loss value in an embodiment of the present application. Taking the training sample set containing three sample programs as an example, and taking the text modality sample of one of the sample programs as an example, the modality vector of the text modality sample is used as an anchor point, the modality vectors of other multimodal samples of the sample program are used as positive sample pairs (i.e., k+), and the modality vectors of multimodal samples of other sample programs are used as negative sample pairs (i.e., k-), then the infoNCE loss is calculated based on the positive sample pairs and the negative sample pairs to obtain the alignment loss value of the text modality sample.

[0096] The embodiment of the present application determines the alignment loss value of a multimodal sample corresponding to a sample program through Formula 1:

[0097]

[0098] in, Represents the alignment loss value of a multimodal sample; Represents the modal vector of the multimodal sample; and each representing the modal vector of other multimodal samples of the same sample program; Represents each multimodal sample in the training sample set; Indicates the temperature constant, which is a preset fixed value.

[0099] and Respectively represent the first similarity between the multimodal sample and other multimodal samples; Indicates that the multimodal sample and the multimodal sample If the similarity between for or It means that the similarity is the first similarity. If , and For other multimodal samples other than , the similarity represents the second similarity.

[0100] It should be noted that the training sample set is a batch of training samples when training the malicious program detection model. For example, the number of sample programs in each batch of training sample sets can be n, and the number of multimodal samples is That is, the number of modal vectors corresponding to the training sample set is indivual.

[0101] The embodiment of the present application may use multiple batches of training sample sets, that is, the total number of sample programs may be N.

[0102] Step S203: determining an alignment loss value corresponding to the sample program based on the alignment loss values ​​of the multiple multimodal samples corresponding to the sample program.

[0103] Based on formula 1, the alignment loss value of each multimodal sample can be obtained. Based on the alignment loss values ​​of multiple multimodal samples corresponding to a sample program, the embodiment of the present application can use the average of the alignment loss values ​​of the multiple multimodal samples corresponding to the sample program as the alignment loss value of the sample program.

[0104] Step S1022: Adjust the parameters of the malicious program detection model based on the alignment loss value of each sample program in the training sample set.

[0105] Among them, each sample program in the training sample set in the embodiment of the present application has a training label, and the embodiment of the present application can also determine the label loss value of the sample program based on the training label of each sample program.

[0106] like Figure 5 As shown, a flowchart of adjusting parameters of a malicious program detection model in an embodiment of the present application is shown, and the specific steps are as follows:

[0107] Step S501, for each sample program in the training sample set, based on multiple multimodal samples corresponding to the sample program, determine the predicted label of the sample program, and based on the predicted label and the training label of the sample program, determine the label loss value corresponding to the sample program.

[0108] like Figure 6As shown, a flowchart of determining a predicted label in an embodiment of the present application, the specific steps are as follows:

[0109] Step S601, concatenate multiple modal vectors corresponding to the sample program to determine a modal concatenation vector corresponding to the sample program.

[0110] Among them, multiple modal vectors are determined respectively according to multiple multimodal samples corresponding to the sample program.

[0111] Step S602: Determine a prediction label corresponding to the sample program based on the modal concatenation vector corresponding to the sample program.

[0112] Optionally, the embodiment of the present application inputs the modal splicing vector corresponding to the sample program into a fully connected layer for classification to obtain a predicted label.

[0113] In this embodiment of the application, a cross entropy loss function may be used to calculate a label loss value.

[0114] like Figure 7 As shown, a schematic diagram of determining a label loss value in an embodiment of the present application is shown. Taking a sample program in a training sample set as an example, the modal vectors of multiple multimodal samples of the sample program are concatenated, and the cross entropy loss is calculated to obtain the label loss value of the sample program.

[0115] Optionally, the embodiment of the present application determines the label loss value of each sample program through Formula 2.

[0116]

[0117] in, Represents the label loss value of a sample program; Represents the training label of the sample program; represents the predicted label of the sample program, , represents the modal concatenation vector corresponding to the sample program, Respectively represent the modal vectors of multiple multimodal samples corresponding to the sample program, and It represents bias, and the bias is adjusted when training the malware detection model to adjust the parameters of the malware detection model.

[0118] It should be noted that when training the malware detection model for the first time, and Set the preset values ​​respectively.

[0119] Step S502, determining a total loss value based on the alignment loss value and label loss value of each sample program in the training sample set.

[0120] like Figure 8 As shown, a schematic diagram of determining an alignment loss value and a label loss value in an embodiment of the present application. Among them, taking the training sample set containing 3 sample programs as an example, and taking the text modality sample of one of the sample programs as an example, the modality vector of the text modality sample is used as an anchor point, the modality vectors of other multimodal samples of the sample program are used as positive sample pairs (i.e., k+), and the modality vectors of multimodal samples of other sample programs are used as negative sample pairs (i.e., k-), then the infoNCE loss is calculated based on the positive sample pairs and the negative sample pairs to obtain the alignment loss value of the text modality sample, and the modality vectors of multiple multimodal samples of the sample program are spliced, and the cross entropy loss is calculated to obtain the label loss value of the sample program.

[0121] It should be noted that Figure 8 The process shown can be accomplished through MMLMD multimodal contrastive learning.

[0122] Optionally, the embodiment of the present application determines the reference loss value of the sample program through Formula 3.

[0123]

[0124] in, represents the reference loss value of the sample program, represents the alignment loss value of the sample program, Represents the label loss value of the sample program.

[0125] In this embodiment of the present application, the sum of the reference loss values ​​of each sample program in the training sample set is taken as the total loss value.

[0126] Step S503: Adjust the parameters of the malicious program detection model based on the total loss value.

[0127] Optionally, the embodiment of the present application performs gradient descent based on the total loss value to train the final malicious program detection model.

[0128] like Fig. 9As shown, an overall schematic diagram of a training malicious detection model in an embodiment of the present application. Among them, if the electronic device is Microsoft, the sample program used in the embodiment of the present application can be a windows PE file provided by Microsoft. Then the embodiment of the present application converts the PE file into a bit sequence, and converts the bit sequence into three modes: hexadecimal sequence, image and assembly sequence. Construct a respective detection model for each modality, and use gradient descent to update the detection model. After the training of the respective detection models of each modality is completed, extract the respective feature vectors of the three modalities corresponding to the PE file, calculate the infoNCE loss and cross entropy loss based on the respective feature vectors of the three modalities, perform gradient descent based on the results of the infoNCE loss and the results of the cross entropy loss, and adjust the parameters of the malicious program detection model.

[0129] When the trained malicious program detection model is applied, the malicious program detection model collects programs in the electronic device, obtains the feature vectors of the program in the three modes respectively through the detection models corresponding to the three modes in the malicious program detection model, and determines whether the program is a malicious program based on the feature vectors in the three modes.

[0130] In an optional implementation, the embodiments of the present application can be applied in the scenario of smart home security. The malicious program detection model can be used to protect home automation devices, such as smart cameras, smart door locks, and smart appliances. The model scans the storage or firmware of the device and checks the binary code therein to find malware signatures, vulnerabilities, or other potential threats. If an abnormality is found, the model can automatically trigger an alarm to notify the user or recommend taking necessary security measures, such as upgrading firmware, changing default passwords, or isolating potentially infected devices to maintain the privacy and security of the family.

[0131] When training the malicious program detection model, the training sample set is determined by collecting malicious programs in smart homes and embedded systems. Each sample program in the training sample set is converted into a bit sequence, and the first 2000 bits are retained, and converted into multiple multimodal samples based on the bit sequence. Based on the modal type of the multimodal sample, an independent detection model corresponding to each modal type is trained respectively, and the modal features of each multimodal sample are obtained based on the trained three independent detection models. The malicious program detection model is trained based on the modal features of each multimodal sample and the three independent detection models. After the training is completed, the trained malicious program detection model is deployed in the smart home, and the storage or firmware of the device is scanned regularly to check the binary code therein. If an abnormality is found, the model can automatically trigger an alarm, notify the user and isolate the infected device to maintain the privacy and security of the family.

[0132] In an optional implementation, the embodiment of the present application can be applied in the scenario of an automated anti-virus engine. An automated anti-virus engine based on a malicious program detection model plays a vital role in network security. Even in the face of malware variants, this engine can automatically detect and isolate or delete known malware. This automated process provides strong protection for end users and corporate networks, reducing the risk of potential threats. In addition, this automated method also significantly reduces the burden on security teams and can handle malware in real time without manual intervention.

[0133] Among them, by collecting malicious programs in the Windows system, a training sample set is determined. The training process is similar to the principle type of the training process in the above application scenario, and this application will not repeat it here. After the training is completed, the trained malicious program detection model is deployed to the automated anti-virus engine. The engine scans all programs in the device as required by the customer and checks the device binary code. If an abnormality is found, the model can isolate the program and report the program to the cloud for filing.

[0134] It should be noted that existing malware detection models often rely too much on a single information source (such as hexadecimal sequences or images), making it vulnerable to attackers evading attacks. The method proposed in this application (MMLMD) extracts features from three modalities: hexadecimal sequences, binary images, and assembly language instruction sequences of malware. The data source of each modality contains information of different levels and types. By integrating multiple modal information, the richness and comprehensiveness of data representation are improved. This multimodal learning method enhances the robustness of the model. Even if a certain modality is interfered with or attacked, other modalities can still provide sufficient information to support accurate decision-making, thereby significantly reducing the risk of the model being bypassed. This redundancy helps to reduce false alarm rates and improve the security of the system.

[0135] In addition, the MMLMD method of the present application introduces a self-supervised contrastive learning mechanism and ensures that the semantic vectors of the same sample in different modalities are as close as possible through a specific InfoNCELoss function, thereby solving the problem of alignment of data of different modalities in the semantic space. This method does not rely on manually annotated matching information, but instead uses the characteristics of the data itself for learning, which improves the semantic consistency between modalities, and therefore has greater universality and applicability. In this way, the MMLMD method effectively solves the problem of detection errors caused by misaligned information between modalities, and significantly improves the detection model's ability to adapt to complex and changeable malware samples and its ability to resist evasion attacks.

[0136] like Fig.10 As shown, a model training device according to an embodiment of the present application includes:

[0137] The acquisition module 1001 is used to acquire a training sample set, wherein the sample set includes a plurality of sample programs and a plurality of multimodal samples corresponding to each of the plurality of sample programs; wherein the plurality of multimodal samples corresponding to each sample program respectively represent information of different modal types;

[0138] The training module 1002 is used to iteratively train the malicious program detection model to be trained based on the training sample set to obtain a trained malicious program detection model, wherein in each round of iterative training, the following operations are performed: for each sample program in the training sample set, the following operations are performed respectively: based on the first similarity between multiple multimodal samples corresponding to the sample program, and the second similarity between each of the multiple multimodal samples corresponding to the sample program and other multimodal samples in the training sample set, the alignment loss value of the sample program is determined; based on the alignment loss value of each sample program in the training sample set, the parameters of the malicious program detection model are adjusted.

[0139] Based on the same inventive concept as the above-mentioned method embodiment, an electronic device is also provided in the embodiment of the present application. The principle of solving the problem by the electronic device is similar to the method of the above-mentioned embodiment. Therefore, the implementation of the electronic device can refer to the implementation of the above-mentioned method, and the repeated parts will not be repeated.

[0140] See also Fig.11 As shown, the electronic device 110 may include at least a processor 111 and a memory 112. The memory 112 stores a program code, and when the program code is executed by the processor 111, the processor 111 executes the steps of the model training method in the above embodiment of the present application.

[0141] Refer to the following Fig.12 The electronic device 120 according to this embodiment of the present application is described. Fig.12 The electronic device 120 is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0142] like Fig.12 The electronic device 120 is presented in the form of a general electronic device. The components of the electronic device 120 may include, but are not limited to: at least one processing unit 121, at least one storage unit 122, and a bus 123 connecting different system components (including the storage unit 122 and the processing unit 121).

[0143] Bus 123 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0144] The storage unit 122 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1221 and / or a cache memory 1222 , and may further include a read-only memory (ROM) 1212 .

[0145] The storage unit 122 may also include a program / utility 1212 having a set (at least one) of program modules 1224, such program modules 1224 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0146] The electronic device 120 may also communicate with one or more external devices 124 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable an object to interact with the electronic device 120, and / or communicate with any device that enables the electronic device 120 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 125. In addition, the electronic device 120 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 126. As shown, the network adapter 126 communicates with other modules for the electronic device 120 through a bus 123. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 120, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0147] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0148] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0149] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0150] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0151] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A model training method, characterized in that: The method comprises: Acquire a training sample set, wherein the training sample set includes a plurality of sample programs and a plurality of multimodal samples corresponding to each of the plurality of sample programs; wherein the plurality of multimodal samples corresponding to each sample program respectively represent information of different modal types; Iteratively train the malicious program detection model to be trained based on the training sample set to obtain a trained malicious program detection model, wherein in each round of iterative training, the following operations are performed: For each sample program in the training sample set, perform the following operations respectively: respectively determining modal vectors of a plurality of multimodal samples corresponding to the sample program; For each multimodal sample corresponding to the sample program, the following operations are performed respectively: based on the modal vector of the multimodal sample and other modal vectors corresponding to the sample program, a first similarity between the multimodal sample and other multimodal samples corresponding to the sample program is determined; based on the modal vector of the multimodal sample and the modal vectors corresponding to other sample programs in the training sample set, a second similarity between the multimodal sample and multimodal samples corresponding to other sample programs is determined; based on the first similarity between the multimodal sample and other multimodal samples corresponding to the sample program, and the second similarity between the multimodal sample and multimodal samples corresponding to other sample programs, an alignment loss value of the multimodal sample is determined; Determining an alignment loss value corresponding to the sample program based on alignment loss values ​​of a plurality of multimodal samples corresponding to the sample program; Based on the alignment loss value of each sample program in the training sample set, the malicious program detection model is adjusted.

2. The method according to claim 1, characterized in that The plurality of multimodal samples include text modality samples, image modality samples and code modality samples; The text modality samples are used to represent machine language type information, the image modality samples are used to represent visual type information, and the code modality samples are used to represent code logic type information.

3. The method according to claim 1, characterized in that The determining, based on the alignment loss value corresponding to each multimodal sample corresponding to the sample program, the alignment loss value corresponding to the sample program comprises: The average of the alignment loss values ​​of the multiple multimodal samples corresponding to the sample program is used as the alignment loss value of the sample program.

4. The method according to claim 1, characterized in that Each sample program in the training sample set has a training label, and adjusting the parameters of the malicious program detection model based on the alignment loss value of each sample program in the training sample set includes: For each sample program in the training sample set, based on a plurality of multimodal samples corresponding to the sample program, determine a predicted label of the sample program, and based on the predicted label of the sample program and the training label, determine a label loss value corresponding to the sample program; Determine a total loss value based on the alignment loss value and the label loss value of each sample program in the training sample set; The malicious program detection model is adjusted based on the total loss value.

5. The method according to claim 4, characterized in that The step of determining a predicted label of the sample program based on a plurality of multimodal samples corresponding to the sample program includes: Splicing a plurality of modal vectors corresponding to the sample program to determine a modal splicing vector corresponding to the sample program; the plurality of modal vectors are respectively determined according to a plurality of multimodal samples corresponding to the sample program; Based on the modal concatenation vector corresponding to the sample program, a prediction label corresponding to the sample program is determined.

6. A model training device, characterized in that: The device comprises: An acquisition module is used to acquire a training sample set, wherein the sample set includes a plurality of sample programs and a plurality of multimodal samples corresponding to each of the plurality of sample programs; wherein the plurality of multimodal samples corresponding to each sample program respectively represent information of different modal types; A training module, for iteratively training a malicious program detection model to be trained based on the training sample set to obtain a trained malicious program detection model, wherein in each round of iterative training, the following operations are performed: for each sample program in the training sample set, the following operations are performed respectively: modal vectors of a plurality of multimodal samples corresponding to the sample program are respectively determined; for each multimodal sample corresponding to the sample program, the following operations are performed respectively: based on the modal vector of the multimodal sample and other modal vectors corresponding to the sample program, a first similarity between the multimodal sample and other multimodal samples corresponding to the sample program is determined; based on the modal vector of the multimodal sample and other modal vectors corresponding to the sample program, a first similarity between the multimodal sample and other multimodal samples corresponding to the sample program is determined; based on the modal vector of the multimodal sample The method comprises the following steps: determining a second similarity between the multimodal sample and the multimodal samples corresponding to other sample programs respectively based on the modal vector and the modal vectors corresponding to other sample programs in the training sample set; determining an alignment loss value of the multimodal sample based on the first similarity between the multimodal sample and the other multimodal samples corresponding to the sample program respectively, and the second similarity between the multimodal sample and the multimodal samples corresponding to other sample programs respectively; determining an alignment loss value corresponding to the sample program based on the alignment loss values ​​of multiple multimodal samples corresponding to the sample program; and adjusting parameters of the malicious program detection model based on the alignment loss value of each sample program in the training sample set.

7. An electronic device, characterized in that: The method comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computer, and when the program is run on the computer, the computer is enabled to execute the method according to any one of claims 1 to 5.

9. A computer program product, characterized in that When the computer program product is called by a computer, the computer is caused to execute the method according to any one of claims 1 to 5.

Images