A malware detection and classification method and system based on multimodal feature fusion

Abstract

The present invention discloses a malware detection and classification method and system based on multimodal feature fusion, the method comprising: constructing a malware detection and classification model; obtaining static and dynamic information data of an input software sample; preprocessing the static and dynamic information data; extracting features from the preprocessed static and dynamic information data based on the malware detection and classification model to obtain feature vectors; fusing the feature vectors based on a feature fusion module; calculating the Euclidean distance between the multimodal feature vector and the malware family prototype based on a hierarchical contrastive learning network; and outputting classification results based on the Euclidean distance. The system comprises an information data acquisition module, a preprocessing module, a feature extraction module, a feature fusion module, a hierarchical contrastive learning module, and a classification output module. By using the present invention, malware can be detected and classified with a small sample size. The present invention can be widely applied to the field of network security technology.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a malware detection and classification method and system based on multimodal feature fusion. Background Art

[0002] Malware is a type of software with malicious behavior that can cause damage to computer systems, data or users. Common types of malware include viruses, worms, Trojans, spyware and ransomware. With the rapid development and popularization of Internet technology, the number of malware has also shown explosive growth. Network security personnel need to continuously study and learn the latest features of these malware to improve the protection capabilities of cyberspace security. Traditional malware detection methods are mainly divided into methods that use disassembly and other technologies to perform static analysis on features including bytecodes, assembly instructions, operators, etc. and dynamic analysis methods that run in a sandbox and observe the behavior characteristics of malware. However, as malware evolves and iterates, malware developers often use more and more complex technologies to make malware evade detection. The latest malware often uses encryption, obfuscation, polymorphism and other packaging technologies to hinder static analysis technologies and use anti-debugging and anti-virtual machine packaging technologies to identify the environment in which the malware runs, protecting and hiding malicious behaviors. In addition, the latest malware containing these features often has only a few samples, and it is impossible to use a large number of samples to train and converge the model in the traditional deep learning environment to achieve a good detection effect. Therefore, malware with few samples has become a major issue in the current malware detection field.

[0003] There are several ways to analyze malware based on its runtime behavior:

[0004] 1. Using hardware-assisted malware analysis usually refers to using a set of hardware performance counters (HPCs) in the CPU that store hardware events to count and analyze specific hardware instruction events of the CPU during software execution. Malware can be identified by comparing the differences in instruction features used during normal software and malware execution.

[0005] 2. Use the API call graph at the time of application running to perform malware analysis. Usually, all API calls during the operation of malware are collected, and the differences in sensitive API calls in the Windows system are analyzed by comparing normal software and malware during operation, so as to identify malware. However, it is easy to be attacked by adversarial samples against the API call graph.

[0006] 3. Use the network traffic access requests during the running of the application to perform malware analysis. Usually, all network traffic access requests during the running of the malware are collected, and the abnormal network traffic access requests are found by comparing the packet-level network traffic access requests of normal software and malware during the running process, so as to identify the malware.

[0007] The above malware analysis methods all require a large number of malware samples to train a good model. For these latest malware, due to the inability to provide a large number of samples, it is impossible to train a good malware detection model from the existing technical solutions. In addition, the above malware analysis methods do not fully utilize all the feature information of the malware at the time of running to check and analyze the malware, and the malware classifier trained in this way may result in a high false alarm rate. Summary of the invention

[0008] In order to solve the above technical problems, the purpose of the present invention is to provide a malware detection and classification method and system based on multimodal feature fusion, which can detect and classify malware by utilizing multiple features in the malware running process with a small sample size.

[0009] The first technical solution adopted by the present invention is: a malware detection and classification method based on multimodal feature fusion, comprising the following steps:

[0010] Construct malware detection classification models based on fully connected neural networks, convolutional neural networks, long short-term memory networks, graph convolutional networks, gated neural networks, feature fusion modules, hierarchical contrastive learning networks, and prototype networks;

[0011] Obtain static and dynamic information data of input software samples;

[0012] Preprocessing the static and dynamic information data to obtain preprocessed static and dynamic information data;

[0013] Inputting the preprocessed static and dynamic information data into the malware detection classification model for feature extraction to obtain a feature vector;

[0014] Based on the feature fusion module, the feature vectors are fused to obtain a multimodal feature vector;

[0015] Calculating the Euclidean distance between the multimodal feature vector and the malware family prototype based on the hierarchical contrastive learning network;

[0016] The nearest malware family sample label is output based on the Euclidean distance to obtain a classification result.

[0017] Furthermore, the step of constructing a malware detection classification model based on a fully connected neural network, a convolutional neural network, a long short-term memory network, a graph convolutional network, a gated neural network, a feature fusion module, a hierarchical contrastive learning network, and a prototype network specifically includes:

[0018] A feature extractor is constructed based on fully connected neural networks, convolutional neural networks, long short-term memory networks, graph convolutional networks, and gated neural networks to extract features from preprocessed static and dynamic information data;

[0019] A hierarchical prototype contrast classifier is constructed based on hierarchical contrastive learning network and prototype network.

[0020] Furthermore, the loss function of the hierarchical prototype comparison classifier is expressed as follows:

[0021]

[0022]

[0023]

[0024]

[0025] S Ben (x i ,y i )≡{x j |y j =y i =0,x j ≠x i}

[0026] S Mal (x i ,y i )≡{x j |y j =y i ,x j ≠x i}

[0027] S MalNoFam (x i ,y i )≡{x j |y j ≠y i ≠0,x j ≠x i}

[0028] S BenMal (x i ,y i )≡{x j |y j =0,yi ≠0,x j ≠x i ory j ≠0,y i =0,x j ≠x i}

[0029]

[0030] in, represents the loss function of the hierarchical prototype contrast classifier; represents the level contrast loss; represents the cross entropy loss; Indicates loss of family archetype; represents the regularization loss; γ and ω represent hyperparameters; x i represents the i-th input sample; y i represents the true label of the i-th input sample; represents the prototype of the malware family of the i-th input sample; S Ben (·) represents the set of benign samples; S Mal (·) represents the set of malware samples belonging to the same family; S MalNoFam (·) represents the set of different malware samples belonging to the same family; S BenMal (·) indicates a set of two samples, one is a benign software sample and the other is a malware sample; emb(·) indicates an embedding function; represents the Euclidean distance between two samples after the embedding function; β represents the preset maximum Euclidean distance index; α represents the preset minimum Euclidean distance index; f(·) represents the hierarchical prototype comparison classifier for sample x i prediction results.

[0031] Furthermore, the static and dynamic information data include raw binary data, control flow data, HPCs data, memory dump data, network traffic access request data and malware API call data.

[0032] Furthermore, the step of preprocessing the static and dynamic information data to obtain preprocessed static and dynamic information data specifically includes:

[0033] Converting the control flow data into a control flow graph and saving it in the form of an adjacency matrix to obtain a preprocessed program control flow graph;

[0034] Converting the memory dump data into a colored memory dump image to obtain a preprocessed memory dump data image;

[0035] Screening the network traffic access request data and performing sequence data conversion to obtain a preprocessed network traffic access request sequence vector;

[0036] The malware API call data is converted into an API call graph and saved in the form of an adjacency matrix to obtain a preprocessed API call graph.

[0037] Furthermore, the step of inputting the pre-processed static and dynamic information data into the malware detection classification model for feature extraction to obtain a feature vector specifically includes:

[0038] Performing feature extraction on the original binary data based on the gated neural network to obtain an original binary feature vector;

[0039] Performing feature extraction on the HPCs data based on the fully connected neural network to obtain an HPCs feature vector;

[0040] Performing feature extraction on the preprocessed memory dump data image based on the convolutional neural network to obtain a memory dump feature vector;

[0041] Performing feature extraction on the preprocessed network traffic access request sequence vector based on the long short-term memory network to obtain a network traffic access request feature vector;

[0042] Performing feature extraction on the preprocessed program control flow graph based on the graph convolutional network to obtain a program control flow graph feature vector;

[0043] Based on the graph convolutional network, feature extraction is performed on the preprocessed API call graph to obtain an API call graph feature vector.

[0044] Further, the step of fusing the feature vectors based on the feature fusion module to obtain a multimodal feature vector specifically includes:

[0045] The feature vectors are filled respectively based on the zero filling method, adjusted to the same dimension, and the filled feature vectors are obtained.

[0046] Performing a bit-by-bit addition operation on the filled original binary feature vector and the filled program control flow graph feature vector to obtain a fused static feature vector;

[0047] Performing a horizontal splicing operation on the padded HPCs feature vector, the padded memory dump feature vector, the padded network traffic access request feature vector, and the padded API call graph feature vector to obtain a spliced ​​feature vector;

[0048] Segmenting the spliced ​​feature vector, and then performing weighted average summation on the elements of the segmented feature vector to obtain a fused dynamic feature vector;

[0049] Weight coefficients are added to the fused static feature vector and the fused dynamic feature vector respectively, and a bit-by-bit addition operation is performed to obtain a multimodal feature vector.

[0050] Furthermore, the Euclidean distance between the multimodal feature vector and the malware family prototype is expressed as follows:

[0051] d begin =||emb(v mulitimodal )-pro 0 ||

[0052] d malware i =||emb(v mulitimodal )-pro i ||

[0053] Among them, d begin represents the distance between the multimodal feature vector and the prototype of the benign software family after the embedding function; emb(v mulitimodal ) represents the sample position of the multimodal feature vector in the embedding space after the embedding function; pro 0 Represents a family of prototypes of benign software in the embedding space; pro i represents the prototype of the i-th malware family in the embedding space; d malware i Represents the distance between the multimodal feature vector and the prototype of the i-th malware family after the embedding function.

[0054] The second technical solution adopted by the present invention is: a malware detection and classification system based on multimodal feature fusion, comprising:

[0055] An information data acquisition module, used to extract raw binary data, control flow data, HPCs data, memory dump data, API call data, and network traffic access request data of input software samples;

[0056] A preprocessing module, used for preprocessing static and dynamic information data to obtain preprocessed static and dynamic information data;

[0057] A feature extraction module, used to convert the preprocessed static and dynamic information data into corresponding feature vectors;

[0058] A feature fusion module is used to fuse feature vectors to obtain multimodal feature vectors;

[0059] A hierarchical contrastive learning module for mapping the multimodal feature vector into an embedding space and calculating the Euclidean distance between the multimodal feature vector and the malware family prototype in the embedding space;

[0060] The classification output module outputs the nearest malware family sample label based on the Euclidean distance to obtain a classification result.

[0061] The third technical solution adopted by the present invention is: a malware detection and classification device based on multimodal feature fusion, comprising:

[0062] at least one processor;

[0063] at least one memory for storing at least one program;

[0064] When the at least one program is executed by the at least one processor, the at least one processor implements the above-mentioned malware detection and classification method based on multimodal feature fusion.

[0065] The beneficial effects of the method and system of the present invention are as follows: the present invention utilizes a variety of static and dynamic information of a small number of samples of malware, converts them into appropriate feature vectors respectively and fuses them, realizes the effect of multimodal fusion feature vectors, and maps these fused multimodal feature vectors into an embedding space through an embedding function module, so as to better perform classification learning. Applying the ideas of hierarchical contrast learning and prototype networks, malware and benign software are first divided into two clusters, and then the result of malware family classification is achieved by increasing the Euclidean distance between malware samples of different families, and finally the center of each family is obtained through the family prototype calculation module, so as to more accurately detect the predicted samples and predict the family in the classification module; finally, with a small number of samples, a variety of features in the malware running process are used to construct an excellent malware detection and classifier, which can not only realize the classification of benign and malware, but also classify malware families. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 It is a flowchart of the steps of a malware detection and classification method based on multimodal feature fusion of the present invention;

[0067] Figure 2 It is a structural block diagram of a malware detection and classification system based on multimodal feature fusion of the present invention;

[0068] Figure 3 It is a schematic diagram of a static information data acquisition process of a malware detection and classification method based on multimodal feature fusion of the present invention;

[0069] Figure 4It is a schematic diagram of a dynamic information data acquisition process of a malware detection and classification method based on multimodal feature fusion of the present invention;

[0070] Figure 5 It is a schematic diagram of the preprocessing module flow of a malware detection and classification method based on multimodal feature fusion according to the present invention;

[0071] Figure 6 It is a flow chart of a feature extraction module of a malware detection and classification method based on multimodal feature fusion according to the present invention;

[0072] Figure 7 It is a feature fusion module flow chart of a malware detection and classification method based on multimodal feature fusion in the present invention. DETAILED DESCRIPTION

[0073] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The step numbers in the following embodiments are only provided for the convenience of explanation and description, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0074] Reference Figure 1 The present invention provides a malware detection and classification method based on multimodal feature fusion, the method comprising the following steps:

[0075] S1. Construct malware detection and classification models based on fully connected neural networks, convolutional neural networks, long short-term memory networks, graph convolutional networks, gated neural networks, feature fusion modules, hierarchical contrastive learning networks, and prototype networks;

[0076] S1.1. Construct a feature extractor based on fully connected neural network, convolutional neural network, long short-term memory network, graph convolutional network and gated neural network to extract features from preprocessed static and dynamic information data.

[0077] Specifically, the fully connected neural network is used to extract HPCs feature vectors, including: a first fully connected layer containing 64 neurons; a first ReLU activation function layer; a second fully connected layer containing 128 neurons; a second ReLU activation function layer; and a third fully connected layer, the total number of neurons of which is the number of malware families in the training set + 1.

[0078] The long short-term memory network is used to extract the network traffic access request feature vector. The long short-term memory network is composed of a group of LSTM modules. The LSTM module includes: an input gate composed of a sigmoid layer and a tanh layer; a forget gate that determines whether the previous sample affects the current sample state; a cell state that integrates the input gate output and the forget gate output; and an output gate composed of a sigmoid layer and a tanh layer.

[0079] The graph convolution network is used to extract API call graph feature vectors and program control flow graph feature vectors, and the graph convolution network includes: a linear transformation layer composed of a trainable weight matrix W; a normalization layer; a first ReLU activation function layer; a one-dimensional graph convolution layer; a second ReLU activation function layer; and a fully connected layer whose total number of neurons is the number of malware families in the training set + 1.

[0080] The gated neural network is used to extract the original binary feature vector, and the gated neural network includes: an embedding layer; a one-dimensional convolution layer; a ReLU activation function layer; a time maximum pooling layer; a global channel gating layer; and a fully connected layer whose total number of neurons is the number of malware families in the training set + 1.

[0081] S1.2. Construct a hierarchical prototype contrast classifier based on the hierarchical contrast learning network and the prototype network.

[0082] Specifically, the hierarchical contrastive learning network includes: an embedding layer; a first fully connected layer containing 64 neurons; a first ReLU activation function layer; a second fully connected layer containing 128 neurons; a second ReLU activation function layer; a loss function calculation layer; a fully connected layer with a total number of neurons equal to the number of malware families in the training set + 1; and a classification layer.

[0083] The hierarchical prototype comparison classifier includes an embedding function emb(·) and a classifier cla(·), and the classification result for the input software sample x is f(x)=cla(emb(x));

[0084] For all benign software in the training set, we regard them as a family, and for the families of different malware in the dataset, we map their embedding representations in the embedding space and calculate the prototype representation of each family. Specifically, for family c, the prototype calculation expression is as follows:

[0085]

[0086] Among them, Num c represents the total number of family c in the training set samples; x i represents the i-th input sample; emb(·) represents the embedding function; pro c Represents the prototype of family c.

[0087] Specify pro here 0 Represents a family of prototypes of benign software in the embedding space; pro i represents the i-th malware family prototype in the embedding space.

[0088] Construct the loss function of the hierarchical prototype contrast classifier, which consists of hierarchical contrast loss, cross entropy loss and family prototype loss. In order to prevent the model from overfitting, regularization loss is introduced The loss function of the hierarchical prototype comparison classifier is expressed as follows:

[0089]

[0090]

[0091]

[0092]

[0093] S Ben (x i ,y i )≡{x j |y j =y i =0,x j ≠x i}

[0094] S Mal (x i ,y i )≡{x j |y j =y i ,x j ≠x i}

[0095] S MalNoFam (x i ,y i )≡{x j |y j ≠y i ≠0,x j ≠x i}

[0096] S BenMal (x i ,y i )≡{x j |y j =0,y i ≠0,x j ≠x i ory j ≠0,y i =0,xj ≠x i}

[0097]

[0098] in, represents the loss function of the hierarchical prototype contrast classifier; represents the level contrast loss; represents the cross entropy loss; Indicates loss of family archetype; represents the regularization loss; γ and ω represent hyperparameters, which are used to limit the weight of cross entropy loss and family prototype loss in the model; x i represents the i-th input sample; y i represents the true label of the i-th input sample; represents the prototype of the malware family of the i-th input sample; S Ben (·) represents the set of benign samples; S Mal (·) represents the set of malware samples belonging to the same family; S MalNoFam (·) represents the set of different malware samples belonging to the same family; S BenMal (·) indicates a set of two samples, one is a benign software sample and the other is a malware sample; emb(·) indicates an embedding function; represents the Euclidean distance between two samples after the embedding function; β represents the preset maximum Euclidean distance index; α represents the preset minimum Euclidean distance index; f(·) represents the hierarchical prototype comparison classifier for sample x i prediction results.

[0099] The entire hierarchical contrast loss consists of four parts. The first one requires that the benign software sample is Ben (x i ,y i ) as small as possible; the second item requires that malware samples of the same family Mal (x i ,y i ) as small as possible; the third item requires malware samples from different families to MalNoFam (x i ,y i ) does not exceed the preset maximum Euclidean distance index β, but it cannot be less than the preset minimum Euclidean distance index α, that is, In order to distinguish different malware; the fourth item requires maximizing the Euclidean distance between malware and benign software, making them as far apart as possible in the embedding space.

[0100] After the malware detection and classification model is built, the model is trained using the Adam optimizer with a learning rate of 0.01% and a total of 1000 epochs.

[0101] S2, obtaining static and dynamic information data of the input software sample;

[0102] Specifically, the static and dynamic information data include raw binary data, control flow data, HPCs data, memory dump data, network traffic access request data and malware API call data.

[0103] Reference Figure 3 , extract the PE file of the input software sample into the original binary data file data binary .

[0104] The steps to obtain the control flow information data of the input software sample include configuring the IDAPro application, clicking the Open option in the File file option, opening the input software sample, waiting for the disassembly to be completed, finding the program entry main function of the input software sample in the disassembly window, right-clicking to generate a control flow graph, recording each node of the control flow graph and the operations performed by the node, using Python to write a program to save the control flow graph in IDAPro, and obtaining the control flow information data CFG , and save it as an excel file.

[0105] Reference Figure 4 , obtain HPCs information data of the input software sample, the steps of which include configuring the Intel VTune Profiler application before the input software sample runs, creating an analysis project, selecting the specified input software sample program process, selecting Hardware Events in the analysis type, selecting "LOAD", "STORE", "BRANCHES", "L1_HIT", "L1_MISS", "L3_HIT", "L3_MISS", "CYCLE" events as target events to be sampled, enabling the VTune Profiler application for analysis, and running the input software sample to obtain HPCs data of the target event HPCs , and save it as a .csv file.

[0106] The network traffic access request information data of the input software sample is obtained, wherein the steps include configuring the Wireshark application to capture packets on the local network card before the input software sample is run, and after the Wireshark application starts to capture network traffic, running the input software sample to obtain the network traffic access request data of the input software sample during execution. network , and save it as a .csv file.

[0107] The steps of obtaining API call information data of the input software sample include configuring the Process Monitor application before the input software sample is run, setting the process name in the Filter option to the specified input software sample to filter other applications, capturing the specified Windows kernel API call, running the input software sample, and obtaining the Windows kernel API call information data of the input software sample during execution. API , and save it as a .csv format file.

[0108] Obtain memory dump information data of the input software sample, the steps of which include configuring and debugging the ProcDump application before the input software sample runs, running the input software sample and recording the process PID of the input software sample, and after the input software sample runs for at least 15 minutes, using the CMD command line to enter the command procdump-ma <pid>memory_dump.dmp, obtain the memory dump information data after the input software sample is unpacked during operation memory , and save it as a .dmp file.

[0109] S3, preprocessing the static and dynamic information data to obtain preprocessed static and dynamic information data;

[0110] Reference Figure 5 , convert the control flow data of the input software sample into a control flow graph, use the pandas library in Python to read the Excel document that saves the control flow data, use the networkx library in Python to construct the control flow data in the Excel document into an adjacency matrix, and calculate the out-degree and in-degree between nodes, save the nodes, edges, node indexes, out-degree and in-degree attributes of the nodes in .npy file format, and obtain the preprocessed program control flow graph pre CFG , the program control flow graph after preprocessing is expressed as follows:

[0111] pre CFG =trans(data CFG )

[0112] Among them, pre CFG represents the program control flow graph after preprocessing; trans(·) represents the preprocessing of raw data through Python.

[0113] The memory dump data of the input software sample is converted into a color image. The binary memory dump data file is converted into a pixel point and a color value every three consecutive bytes. The converted image is scaled using the Lanczos interpolation method. The image is uniformly scaled to 300*300 pixels. The preprocessed memory dump image is obtained. memory , saved as a .jpg file format, the preprocessed memory dump image is expressed as follows:

[0114] pre memory =trans(data memory )

[0115] The API call data of the input software sample is converted into an API call graph and saved in the form of an adjacency matrix to obtain the preprocessed API call graph pre API , which is expressed as follows:

[0116] pre API =trans(data API )

[0117] The network traffic access request data of the input software sample is cleaned and converted into a vector. The pandas library in Python is used to read the csv file that saves the network traffic access request, and irrelevant data packets such as system updates, common IP accesses such as access to Microsoft, and ARP access requests are excluded. The required fields, including timestamp, source IP, destination IP, protocol, and packet size, are extracted. The timestamp is converted into a time series format, and the data is arranged and standardized to obtain the preprocessed network traffic access request sequence vector pre network , and save it as a .npy file; the preprocessed network traffic access request sequence vector is expressed as follows:

[0118] pre network =trans(data network ).

[0119] S4, inputting the preprocessed static and dynamic information data into the malware detection classification model for feature extraction to obtain a feature vector;

[0120] S4.1. Extracting features from the original binary data based on the gated neural network to obtain an original binary feature vector;

[0121] Specifically, refer to Figure 6 , the entire original binary executable file of the input software sample is taken as input, and input into the gated neural network model MalConv2 model, an embedding layer is used to convert each byte of the input sequence into a vector of fixed dimension, a one-dimensional convolution is used to extract local features from the embedded vector, and a ReLU activation function is used to make it nonlinear, and a time maximum pooling is used to reduce the feature dimension while retaining the most important activation value, and a global context vector is used to control the feature activation of different time steps using global channel gating, and a fully connected layer is used to further integrate the feature map after global channel gating, and the vector processed by the fully connected layer is saved as the original binary feature vector of the input software sample, which is expressed as follows:

[0122] v binary =MalConv2(data binary )

[0123] Among them, v binary Represents the original binary feature vector; data binary represents the original binary data; MalConv2(·) represents the process of extracting the original binary feature vector of the sample using a gated neural network.

[0124] S4.2, extracting features from the HPCs data based on the fully connected neural network to obtain an HPCs feature vector;

[0125] Specifically, the csv file that stores the HPCs data of the input software sample is read using the pandas library in Python, and the 8 recorded events are extracted to construct features. The feature data is standardized using StandardScaler, and then passed through the first fully connected layer containing 64 neurons. The ReLU activation function is used to add nonlinear mapping, and then the mapped feature vector is input into the second fully connected layer containing 128 neurons. The ReLU activation function is also used to add nonlinear mapping, and then the mapped features are input into the third fully connected layer with a total number of malware families in the training set + 1, and a one-dimensional feature vector is output as the HPCs feature vector of the input software sample. Its expression is as follows:

[0126] v HPCs =MLP(data HPCs )

[0127] Among them, v HPCs represents the HPCs feature vector; MLP(·) represents the process of extracting the sample HPCs feature vector using a fully connected neural network.

[0128] S4.3, based on the convolutional neural network, feature extraction is performed on the preprocessed memory dump data image to obtain a memory dump feature vector

[0129] The preprocessed memory dump data image of the input software sample is used for feature extraction using a convolutional neural network. The image is processed and converted into a three-channel image feature vector using the transforms function in the torchvision library in Python. Features are extracted through a convolution layer consisting of 32 two-dimensional convolution kernels, and then feature dimension reduction is performed through a global average pooling layer to reduce the amount of data and retain important features. The reduced feature vector is input into a fully connected layer with a total number of malware families in the training set + 1, and a one-dimensional feature vector is output as the memory dump feature vector of the input software sample. Its expression is as follows:

[0130] v memory =Conv(data memory )

[0131] Among them, v memory represents the memory dump feature vector; Conv(·) represents the process of extracting the feature vector of the sample memory dump image using a convolutional neural network.

[0132] S4.4, extracting features from the preprocessed network traffic access request sequence vector based on the long short-term memory network to obtain a network traffic access request feature vector;

[0133] Specifically, the preprocessed network traffic access request sequence vector of the input software sample is input into the long short-term memory neural network, and converted into a tensor and input into the input gate of the long short-term memory neural network. After passing through a sigmoid layer and a tanh layer, the output result of the previous sample is input into the forget gate. The forget gate determines to what extent the current input data and the hidden state at the previous moment affect the current state. The output of the forget gate and the output result of the input gate are integrated to update the cell state. The updated cell state is input into the output gate. After passing through a sigmoid layer and a tanh layer, the output gate determines how much influence the current cell state has on the hidden state and output at the next moment. The feature vector of the output gate is saved as the network traffic access request feature vector of the input software sample. Its expression is as follows:

[0134] v network =LSTM(pre network )

[0135] Among them, v networ k represents the network traffic access request feature vector; LSTM(·) represents the process of extracting the sample network traffic access request feature vector using a long short-term memory neural network.

[0136] S4.5. Extracting features of the preprocessed program control flow graph based on the graph convolutional network to obtain a program control flow graph feature vector;

[0137] Specifically, the npy file of the preprocessed program control flow graph of the input software sample is loaded using the Numpy library in Python, which contains nodes, edges, node indexes, node out-degree and in-degree attributes, and is converted into a node feature matrix X and an adjacency matrix A, where the shape of the node feature matrix is ​​N*F, where N is the number of nodes and F is the number of features of each node. The shape of the adjacency matrix A is N*N. The adjacency feature aggregation is obtained by multiplying the adjacency matrix and the node feature matrix, and a trainable weight matrix W is used to perform a linear transformation on it. The matrix after the linear transformation is normalized through a normalization operation to prevent gradient explosion or disappearance, and a ReLU activation function is used to add a nonlinear mapping. The output vector of the graph convolution layer passes through a fully connected layer and outputs the program control flow graph feature vector, which is expressed as follows:

[0138] v CFG =GCN(pre CFG )

[0139] Among them, v CFG represents the feature vector of the program control flow graph; GCN(·) represents the process of extracting the feature vector of the program control flow graph using a graph convolutional neural network.

[0140] S4.6. Perform feature extraction on the preprocessed API call graph based on the graph convolutional network to obtain an API call graph feature vector.

[0141] Specifically, the API call graph feature vector and the program control flow graph feature vector use the same graph convolutional neural network to generate feature vectors. The extraction process of the API call graph feature vector is consistent with the content of step S4.5, and its expression is as follows:

[0142] v API =GCN(pre API )

[0143] Among them, v API represents the feature vector of the API call graph; GCN(·) represents the process of extracting the feature vector of the API call graph using a graph convolutional neural network.

[0144] S5. fusing the feature vectors based on the feature fusion module to obtain a multimodal feature vector;

[0145] S5.1. Fill the feature vectors based on the zero-filling method, adjust them to the same dimension, and obtain filled feature vectors.

[0146] Specifically, refer to Figure 7 , find the original binary feature vector v of the input software sample binary , program control flow graph feature vector v CFG , HPCs feature vector v HPCs 、Memory dump feature vector v memory , network traffic access request feature vector v network and the API call graph feature vector v API The longest feature vector in the image is filled with zeros, and the remaining five feature vectors are filled with zeros to expand the feature vectors to the same length, obtaining the original binary feature vector after filling. The filled program control flow graph feature vector HPCs feature vector after padding Memory dump feature vector after padding Filled API call graph feature vector Its expression is as follows:

[0147] |v max |=max{|v binary |,|v CFG |,|v HPCs |,|v memory |,|v network |,|v API |}

[0148]

[0149]

[0150]

[0151]

[0152]

[0153]

[0154] where |·| represents the length of the feature vector; |v max | represents the length of the longest eigenvector; pad(v,n) is defined as padding the vector v with zeros to length n.

[0155] S5.2, performing a bit-by-bit addition operation on the filled original binary feature vector and the filled program control flow graph feature vector to obtain a fused static feature vector;

[0156] Specifically, the original binary feature vector of the input software sample after padding And the filled program control flow graph feature vector Perform bit-by-bit addition to obtain a fused static feature vector v static , which is expressed as follows:

[0157]

[0158] Here, i represents the index of the i-th element in the vector.

[0159] S5.3, performing a horizontal splicing operation on the filled HPCs feature vector, the filled memory dump feature vector, the filled network traffic access request feature vector, and the filled API call graph feature vector to obtain a spliced ​​feature vector;

[0160] Specifically, the filled HPCs feature vector of the input software sample is Memory dump feature vector after padding Filled network traffic access request feature vector and the filled API call graph feature vector Perform horizontal splicing operation to obtain the spliced ​​feature vector v conat , which is expressed as follows:

[0161]

[0162] S5.4, segmenting the spliced ​​feature vector, and then performing weighted average summation on the elements of the segmented feature vector to obtain a fused dynamic feature vector;

[0163] Specifically, the concatenated feature vector v concat Split into segments equal to the length of the original feature vector, and the length of each segment is the total length of the concatenated feature vector divided by the length of the original feature vector, that is, Then the weighted average of the elements in each segment is summed to obtain the fused dynamic feature vector v dynamic , whose length is the same as that of each original eigenvector, is expressed as follows:

[0164]

[0165] Here, i represents the index of the i-th element in the vector; n represents the length of each segment. Since the vector length has been unified using the zero-filling method, and there are four fixed feature vectors for fusion, the value of n here is 4. concat After being segmented into segments of the same length as the original feature vector, j represents the index of the element in each segment, which takes values ​​from 0 to n-1 one by one and is used to traverse all elements in each segment of length n.

[0166] S5.5, respectively adding weight coefficients to the fused static feature vector and the fused dynamic feature vector, and performing a bit-by-bit addition operation to obtain a multimodal feature vector.

[0167] Specifically, since static features and dynamic features have different weights, static features are generally easily affected by operations such as obfuscation and encryption, while dynamic features often include features after program unpacking and have a relatively high weight ratio. Therefore, the weight parameter of the fused static feature vector is set as τ in the specific embodiment of this method. σ , set the weight parameter of the fused dynamic feature vector to (1-τ) σ , multiply the fused static feature vector and the fused dynamic feature vector by their weight parameters and perform a bit-by-bit addition operation to obtain the multimodal feature vector v of the input sample software mulitimodal , which is expressed as follows:

[0168] v mulitimodal [i] = τ σ υ dynamic [i]+(1-τ) σ υ static [i]

[0169] Among them, i represents the index of the i-th element in the vector, τ and σ represent hyperparameters, and grid search is used to find the optimal hyperparameters during model training.

[0170] S6. Calculating the Euclidean distance between the multimodal feature vector and the malware family prototype based on the hierarchical contrastive learning network;

[0171] Specifically, the embedding function module in the hierarchical contrastive learning network is used to transform the multimodal feature vector v of the input software sample mulitimodal Mapped into the embedding space, the sample position emb(v mulitimodal ); embed the sample position in the space emb(v mulitimodal ) and the prototypes of the benign software families in the training set and each malware family prototype calculate the Euclidean distance, which is expressed as follows:

[0172] d begin =||emb(v mulitimodal )-pro 0 ||

[0173] d malware i =||emb(v mulitimodal )-pro i ||

[0174] Among them, d begin represents the distance between the multimodal feature vector and the prototype of the benign software family after the embedding function; emb(v mulitimodal ) represents the sample position of the multimodal feature vector in the embedding space after the embedding function; pro 0 Represents a family of prototypes of benign software in the embedding space; pro i represents the prototype of the i-th malware family in the embedding space; d malware i Represents the distance between the multimodal feature vector and the prototype of the i-th malware family after the embedding function.

[0175] S7. Output the nearest malware family sample label based on the Euclidean distance to obtain a classification result.

[0176] Specifically, the Euclidean distance between the input sample software and the benign software family and each malware family in the embedding space is sorted, and the expression is as follows:

[0177] sort(d begin ,d malware 1 ,d malware 2 ,...,d malware n )

[0178] Among them, d malware n Represents the Euclidean distance between the input software sample and the last numbered malware family sample.

[0179] The family with the closest Euclidean distance is selected as the prediction result, and its expression is as follows:

[0180]

[0181] Reference Figure 2 The present invention provides a malware detection and classification system based on multimodal feature fusion, comprising:

[0182] An information data acquisition module, used to extract raw binary data, control flow data, HPCs data, memory dump data, API call data, and network traffic access request data of input software samples;

[0183] A preprocessing module, used for preprocessing static and dynamic information data to obtain preprocessed static and dynamic information data;

[0184] A feature extraction module, used to convert the preprocessed static and dynamic information data into corresponding feature vectors;

[0185] A feature fusion module is used to fuse feature vectors to obtain multimodal feature vectors;

[0186] A hierarchical contrastive learning module for mapping the multimodal feature vector into an embedding space and calculating the Euclidean distance between the multimodal feature vector and the malware family prototype in the embedding space;

[0187] The classification output module outputs the nearest malware family sample label based on the Euclidean distance to obtain a classification result.

[0188] The contents of the above method embodiments are all applicable to the present system embodiments. The functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0189] The present invention provides a malware detection and classification device based on multimodal feature fusion, comprising:

[0190] at least one processor;

[0191] at least one memory for storing at least one program;

[0192] When the at least one program is executed by the at least one processor, the at least one processor implements the malware detection and classification method based on multimodal feature fusion.

[0193] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0194] The above is a specific description of the preferred implementation of the present invention, but the invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.< / pid>

Claims

1. A malware detection and classification method based on multimodal feature fusion, characterized in that: The following steps are involved: Construct malware detection classification models based on fully connected neural networks, convolutional neural networks, long short-term memory networks, graph convolutional networks, gated neural networks, feature fusion modules, hierarchical contrastive learning networks, and prototype networks; Obtain static and dynamic information data of input software samples; Preprocessing the static and dynamic information data to obtain preprocessed static and dynamic information data; Inputting the preprocessed static and dynamic information data into the malware detection classification model for feature extraction to obtain a feature vector; Based on the feature fusion module, the feature vectors are fused to obtain a multimodal feature vector; Calculating the Euclidean distance between the multimodal feature vector and the malware family prototype based on the hierarchical contrastive learning network; Outputting the nearest malware family sample label based on the Euclidean distance to obtain a classification result; The step of building a malware detection classification model based on a fully connected neural network, a convolutional neural network, a long short-term memory network, a graph convolutional network, a gated neural network, a feature fusion module, a hierarchical contrastive learning network, and a prototype network specifically includes: A feature extractor is constructed based on fully connected neural networks, convolutional neural networks, long short-term memory networks, graph convolutional networks, and gated neural networks to extract features from preprocessed static and dynamic information data; Construct a hierarchical prototype contrast classifier based on hierarchical contrastive learning network and prototype network; The loss function of the hierarchical prototype comparison classifier is expressed as follows: S Ben (x i ,and i )≡{x j |and j =and i =0,x j ≠x i } S Mal (x i ,and i )≡{x j |and j =and i ,x j ≠x i } S MalNoFam (x i ,y i )≡{x j |y j ≠y i ≠0,x j ≠x i } S BenMal (x i ,y i )≡{x j |y j =0,y i ≠0,x j ≠x i or y j ≠0,y i =0,x j ≠x i } in, represents the loss function of the hierarchical prototype contrast classifier; represents the level contrast loss; represents the cross entropy loss; Indicates loss of family archetype; represents the regularization loss; γ and ω represent hyperparameters; x i represents the i-th input sample; y i represents the true label of the i-th input sample; represents the prototype of the malware family of the i-th input sample; S Ben (·) represents the set of benign samples; S Mal (·) represents the set of malware samples belonging to the same family; S MalNoFam (·) represents the set of different malware samples belonging to the same family; S BenMal (·) indicates a set of two samples, one is a benign software sample and the other is a malware sample; emb(·) indicates an embedding function; represents the Euclidean distance between two samples after the embedding function; β represents the preset maximum Euclidean distance index; α represents the preset minimum Euclidean distance index; f(·) represents the hierarchical prototype comparison classifier for sample x i prediction results.

2. According to claim 1, a malware detection and classification method based on multimodal feature fusion is characterized in that: The static and dynamic information data include raw binary data, control flow data, HPCs data, memory dump data, network traffic access request data and malware API call data.

3. According to claim 2, a malware detection and classification method based on multimodal feature fusion is characterized in that: The step of preprocessing the static and dynamic information data to obtain the preprocessed static and dynamic information data specifically includes: Converting the control flow data into a control flow graph and saving it in the form of an adjacency matrix to obtain a preprocessed program control flow graph; Converting the memory dump data into a colored memory dump image to obtain a preprocessed memory dump data image; Screening the network traffic access request data and performing sequence data conversion to obtain a preprocessed network traffic access request sequence vector; The malware API call data is converted into an API call graph and saved in the form of an adjacency matrix to obtain a preprocessed API call graph.

4. According to claim 3, a malware detection and classification method based on multimodal feature fusion is characterized in that: The step of inputting the pre-processed static and dynamic information data into the malware detection classification model for feature extraction to obtain a feature vector specifically includes: Performing feature extraction on the original binary data based on the gated neural network to obtain an original binary feature vector; Performing feature extraction on the HPCs data based on the fully connected neural network to obtain an HPCs feature vector; Performing feature extraction on the preprocessed memory dump data image based on the convolutional neural network to obtain a memory dump feature vector; Performing feature extraction on the preprocessed network traffic access request sequence vector based on the long short-term memory network to obtain a network traffic access request feature vector; Performing feature extraction on the preprocessed program control flow graph based on the graph convolutional network to obtain a program control flow graph feature vector; Based on the graph convolutional network, feature extraction is performed on the preprocessed API call graph to obtain an API call graph feature vector.

5. The malware detection and classification method based on multimodal feature fusion according to claim 4 is characterized in that: The step of fusing the feature vectors based on the feature fusion module to obtain a multimodal feature vector specifically includes: Filling the feature vectors respectively based on a zero-filling method to adjust them to the same dimension, thereby obtaining filled feature vectors; Performing a bit-by-bit addition operation on the filled original binary feature vector and the filled program control flow graph feature vector to obtain a fused static feature vector; Performing a horizontal splicing operation on the padded HPCs feature vector, the padded memory dump feature vector, the padded network traffic access request feature vector, and the padded API call graph feature vector to obtain a spliced ​​feature vector; Segmenting the spliced ​​feature vector, and then performing weighted average summation on the elements of the segmented feature vector to obtain a fused dynamic feature vector; Weight coefficients are added to the fused static feature vector and the fused dynamic feature vector respectively, and a bit-by-bit addition operation is performed to obtain a multimodal feature vector.

6. The malware detection and classification method based on multimodal feature fusion according to claim 1, characterized in that: The Euclidean distance between the multimodal feature vector and the malware family prototype is expressed as follows: d begin =||emb(v mulitimodal )-pro0|| d malware i =||emb(v mulitimodal )-pro i || Among them, d begin represents the distance between the multimodal feature vector and the prototype of the benign software family after the embedding function; emb(v mulitimodal ) represents the sample position of the multimodal feature vector in the embedding space after the embedding function; pro0 represents the family prototype of the benign software in the embedding space; pro i represents the prototype of the i-th malware family in the embedding space; d malware i Represents the distance between the multimodal feature vector and the prototype of the i-th malware family after the embedding function.

7. A malware detection and classification system based on multimodal feature fusion, characterized in that: The method for performing malware detection and classification based on multimodal feature fusion as claimed in claim 1 comprises: An information data acquisition module, used to extract raw binary data, control flow data, HPCs data, memory dump data, API call data, and network traffic access request data of input software samples; A preprocessing module, used for preprocessing static and dynamic information data to obtain preprocessed static and dynamic information data; A feature extraction module, used to convert the preprocessed static and dynamic information data into corresponding feature vectors; A feature fusion module is used to fuse feature vectors to obtain multimodal feature vectors; A hierarchical contrastive learning module for mapping the multimodal feature vector into an embedding space and calculating the Euclidean distance between the multimodal feature vector and the malware family prototype in the embedding space; The classification output module outputs the nearest malware family sample label based on the Euclidean distance to obtain a classification result.

8. A malware detection and classification device based on multimodal feature fusion, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 6.

Images