Malicious code detection method, system and device based on multi-level feature fusion

Abstract

The present invention relates to the technical field of computer malware detection, and provides a malicious code detection method, system and device based on multi-level feature fusion. The malicious code detection method based on multi-level feature fusion includes: constructing an RGB image based on a bytecode file, extracting and obtaining RGB image features; traversing the bytecode file to obtain N-Gram features; performing hash mapping on the N-Gram features to generate a sparse feature vector of a uniform dimension to obtain bytecode data statistical features; based on an assembly language source file, using a word embedding model to obtain instruction sequence features; fusing RGB image features, bytecode data statistical features and instruction sequence features to obtain fused features; based on the fused features, using a classifier to obtain a detection result. The present invention improves the detection accuracy and response speed of malicious code.

Description

Technical Field

[0001] The present invention relates to the technical field of computer malware detection, and in particular to a malicious code detection method, system and device based on multi-level feature fusion. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Traditional detection methods often identify malicious code based on file signatures, which makes it difficult to deal with malicious code that is not in the signature library, and has a low recognition rate for malicious code that uses techniques such as code obfuscation and code embedding.

[0004] In order to improve the accuracy of malicious code detection, researchers have gradually applied machine learning and deep learning technologies to the field of malicious code detection in recent years. Machine learning models can automatically extract features and classify them by learning a large amount of sample data, thus having greater scalability and flexibility. Detection methods based on machine learning and deep learning are highly dependent on the accuracy of feature extraction. If the feature selection is inappropriate, it may lead to model overfitting or an increase in false positive rates.

[0005] The Chinese patent application number "CN2022104814732" discloses a malware classification method and system based on three-channel visualization and deep learning, which extracts instruction sequences from .asm files and constructs a Markov three-channel graph for malicious code detection. However, the patent only focuses on the instruction sequence of the file, and does not consider the macroscopic distribution of the entire file and the contents of data, resources, and code segments.

[0006] The Chinese patent with application number "CN2021108009076" discloses a malicious code classification method based on a deep residual network and a hybrid attention mechanism. It uses an eight-bit-per-pixel method to construct an RGB image for the .asm file, and integrates the grayscale image of the .bytes file into the RGB image as a transparency channel. However, the patent only considers eight bits per pixel to build the image, which can easily lead to information loss. Important structures and relationships may be ignored, and the context of the sequence itself is also ignored. Summary of the invention

[0007] In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides a malicious code detection method, system and device based on multi-level feature fusion, aiming to improve the detection accuracy and response speed of malicious code.

[0008] In order to achieve the above object, the present invention adopts the following technical solution:

[0009] A first aspect of the present invention provides a malicious code detection method based on multi-level feature fusion.

[0010] A malicious code detection method based on multi-level feature fusion, including:

[0011] Get the bytecode file and assembly language source file of the malicious file;

[0012] Based on the bytecode file, construct an RGB image and extract the RGB image features;

[0013] Traverse the bytecode file to obtain N-Gram features; perform hash mapping on the N-Gram features to generate sparse feature vectors of uniform dimensions to obtain bytecode data statistical features;

[0014] Based on the assembly language source file, the word embedding model is used to obtain the instruction sequence features;

[0015] The RGB image features, bytecode data statistical features and instruction sequence features are fused to obtain fused features;

[0016] Based on the fusion features, a classifier is used to obtain the detection results.

[0017] Furthermore, the bytecode file is used to construct an RGB image; the method includes: sequentially mapping the decimal numbers corresponding to the bytecode file into a matrix, and obtaining a first grayscale image after conversion; performing an LBP transformation based on the first grayscale image, calculating the LBP value in a specified neighborhood, and obtaining an LBP image; processing the LBP image to obtain a second grayscale image; converting the bytecode file into a decimal file, traversing the decimal file, constructing a matrix, and obtaining a third grayscale image after conversion; and combining the first grayscale image, the second grayscale image, and the third grayscale image to construct an RGB image.

[0018] Furthermore, the decimal number sequence corresponding to the bytecode file is mapped into a matrix, and after conversion, a first grayscale image is obtained; the method includes: fixing the height and width of the matrix according to the size of the bytecode file, mapping the decimal number sequence corresponding to the bytecode file into the matrix, converting the matrix into a grayscale image, and using a bilinear interpolation algorithm to reduce the grayscale image to a first grayscale image of a fixed size.

[0019] Furthermore, based on the first grayscale image, an LBP transformation is performed to calculate the LBP value in a specified neighborhood to obtain an LBP image; the LBP image is processed to obtain a second grayscale image; the method includes: applying a local binary pattern transformation to the first grayscale image, comparing each pixel with the pixels around it, generating a binary number based on the comparison result, and converting it into a decimal number as a new pixel value to generate an LBP image; performing Fourier transformation, high-pass filter processing and inverse Fourier transformation on the LBP image in sequence to enhance the texture features of the LBP image; and scaling the enhanced LBP image using a bilinear interpolation method to obtain a second grayscale image.

[0020] Furthermore, the bytecode file is converted into a decimal file, the decimal file is traversed, a matrix is ​​constructed, and a third grayscale image is obtained after conversion; the method includes: converting each byte in the bytecode file into decimal data and establishing a 256×256 matrix; traversing the bytecode file in sequence, obtaining two bytes each time, locating the position in the 256×256 matrix through the values ​​of the two bytes, increasing the grayscale, and obtaining the third grayscale image.

[0021] Furthermore, the sparse feature vector includes: a hash mean feature, a hash standard deviation feature, a hash maximum feature, a hash minimum feature and a hash sum feature.

[0022] Furthermore, the method uses a word embedding model based on the assembly language source file to obtain instruction sequence features; the method includes: traversing the assembly language source file, locating the .text header, writing a regular expression according to the instruction format of the assembly language, and obtaining all instruction sequences in the .text header after screening; generalizing all instruction sequences, inputting the generalized instruction sequences into the word embedding model, and obtaining a word embedding vector representation of each word in each instruction sequence; averaging and aggregating the word embedding vector representations of all words to obtain the instruction sequence features of the assembly language source file.

[0023] Furthermore, the RGB image features, bytecode data statistical features and instruction sequence features are fused to obtain fused features; the method includes: assigning weights to the RGB image features, bytecode data statistical features and instruction sequence features respectively, performing Bayesian weighted fusion, and obtaining fused features.

[0024] A second aspect of the present invention provides a malicious code detection system based on multi-level feature fusion.

[0025] A malicious code detection system based on multi-level feature fusion, including:

[0026] A data acquisition module, configured to: acquire a bytecode file and an assembly language source file of a malicious file;

[0027] The RGB image feature extraction module is configured to: construct an RGB image based on the bytecode file, and extract the RGB image features;

[0028] A hash module is configured to: traverse the bytecode file to obtain N-Gram features; perform hash mapping on the N-Gram features to generate a sparse feature vector of a uniform dimension to obtain bytecode data statistical features;

[0029] A word embedding module is configured to: obtain instruction sequence features based on an assembly language source file using a word embedding model;

[0030] A fusion module is configured to: fuse RGB image features, bytecode data statistical features and instruction sequence features to obtain fusion features;

[0031] The detection module is configured to obtain a detection result by using a classifier based on fusion features.

[0032] A third aspect of the present invention provides a computer device.

[0033] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in the malicious code detection method based on multi-level feature fusion as described in the first aspect above are implemented.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] The present invention uses three channels to capture the macroscopic distribution, local texture features, and the sequence relationship between bytes of the bytecode file. The three-channel image combines global and local information, enhances the sensitivity to malicious code features, and realizes multi-dimensional feature extraction. The present invention uses local binary patterns (LBP) transform and Fourier transform to better capture complex patterns and details. At the same time, it summarizes the text features of instruction features and bytecodes, taking into account both the complex patterns and texture features on image data and the statistical features of byte data, more comprehensively reflecting the complexity and diversity of data and improving the effect of malicious code detection.

[0036] The present invention processes the N-Gram features of text through hash mapping, thereby avoiding the problem of excessive memory occupation by N-Gram of large-scale files. Various aggregate statistics are used on the mapped sparse matrix to ensure that the feature information of each file is simplified into a statistic vector of a fixed size, so that even in the face of large-scale, high-dimensional original hash features, the key information therein can still be retained.

[0037] When extracting RGB images, the present invention utilizes transfer learning and loads the pre-trained parameters of ImageNet, which can greatly reduce the training time of the neural network model, make the model converge faster, and improve the accuracy.

[0038] The present invention converts bytecode into images, which enhances the interpretability of data. Image visualization not only facilitates the observation of various statistical features of data, but also provides security experts with more intuitive attack analysis and helps locate key areas of malicious code. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0040] Figure 1 It is a flow chart of a malicious code detection method based on multi-level feature fusion shown in the present invention. DETAILED DESCRIPTION

[0041] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0042] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0043] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0044] It should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the methods and systems according to various embodiments of the present disclosure. It should be noted that each box in the flowchart or block diagram can represent a module, a program segment, or a part of a code, and the module, program segment, or a part of a code may include one or more executable instructions for implementing the logical functions specified in each embodiment. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, or they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the flowchart and / or block diagram, and the combination of boxes in the flowchart and / or block diagram can be implemented using a dedicated hardware-based system that performs a specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0045] Explanation of terms

[0046] Deep Learning (DL) is an artificial intelligence technology that learns and extracts complex features from data by simulating the neural network structure of the human brain. Deep learning consists of multiple layers of neural networks, each layer processes data step by step, extracting features from low-level to high-level, allowing computers to understand various forms of data such as images, text, and speech. Unlike traditional machine learning methods, deep learning does not require manual feature design, but automatically extracts the optimal features through training with large amounts of data. It has significant advantages in image recognition and can also be used for image feature extraction.

[0047] Word Embedding is a general term for language models and representation learning technologies in natural language processing (NLP). It can convert text into a digital form that is easy for computers to process, so that computers can better understand and process text data. That is, each word is mapped to a point in a vector space, so that words with similar semantics are closer in the vector space, while words with different semantics are farther away.

[0048] Transfer learning is a method in the deep learning training process that improves the learning efficiency and performance of the model by applying the knowledge learned in one field or task to another related field or task. Transfer learning performs well in scenarios with limited data or high training costs. It can use models that have been pre-trained on large-scale datasets (such as ImageNet) and fine-tune or partially retrain the model in new tasks to quickly achieve better performance.

[0049] Fourier Transform is a mathematical transformation. In image processing, Fourier Transform converts an image into a frequency domain representation to reveal the frequency information of the image. It can be used to enhance the details and edges of an image, such as using a high-pass filter to remove the low-frequency components of the image (smooth areas and gradients) in the frequency domain and retain only the high-frequency components (edges and details), thereby highlighting the details in the image. This processing can make the edges of the image clearer and improve the sharpness of the image.

[0050] Embodiment 1

[0051] like Figure 1 As shown, this embodiment provides a malicious code detection method based on multi-level feature fusion. This embodiment uses the method applied to a server as an example. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network servers, cloud communications, middleware services, domain name services, security services CDN, and big data and artificial intelligence platforms. The terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to this. The terminal and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in this application. In this embodiment, the method includes the following steps:

[0052] Step 1: Dataset collection.

[0053] We continuously collect various types of malware in the computer. We use IDA Pro to analyze static PE files and obtain .asm files with PE header information and assembly instructions. We manually write code to statically obtain .bytes files in PE files. We randomly split the data set, with 90% used as the training set and 10% used as the test set.

[0054] Step 2: Build an RGB map for the bytecode file.

[0055] Analyze the .bytes file. First, convert the hexadecimal numbers in the .bytes file to decimal numbers, and construct three-channel images for feature extraction. The first channel: fix the height and width of the matrix according to the file size, map the decimal numbers corresponding to the bytecode file to the matrix in sequence, and convert the resulting matrix into a grayscale image. Use the bilinear interpolation algorithm to reduce it to an image of fixed size. This image can reflect the macroscopic distribution characteristics of the data in the bytecode file; the second channel: use the local binary pattern (LBP) transform on the grayscale image generated by the first channel, compare each pixel with its surrounding pixels, generate a binary number based on the comparison result, and convert this binary number into a decimal number as the new pixel value to generate the corresponding image. Use Fourier transform on the LBP image to convert the image into frequency domain representation, and use a high-pass filter in the frequency domain to further enhance the details and texture information of the image. The representation formula of the image from the spatial domain to the frequency domain is:

[0056]

[0057] Where x and y are the spatial coordinates of the image, is the representation of the input image in the spatial domain, that is, the pixel value of a point in the image, u and v are the frequency domain coordinates, is the kernel function of Fourier transform, j represents the imaginary unit ( ). The frequency domain representation of the image is obtained by multiplying the pixel value of the image in the spatial domain by a sine wave of different frequencies and integrating all positions. .

[0058] The image can excel in capturing local texture features and improve sensitivity to local details. The third channel: convert each byte in the bytecode file into decimal data and establish a 256×256 matrix. Traverse the bytecode file in sequence, obtain two bytes each time, locate the position in the matrix through the values ​​of these two bytes, increase its grayscale, and finally convert the matrix into an image. The image can reflect the sequence relationship between bytes, reveal frequent patterns in the data and the relationship between bytes. Finally, combine the three-channel grayscale image to generate an RGB image.

[0059] Step 3: Extract RGB image features.

[0060] Use a convolutional neural network to extract the RGB image features constructed in step 2. By inputting the RGB image into a pre-trained convolutional neural network (CNN) model, multi-level feature representations are extracted layer by layer. Use a series of convolution, pooling, and activation function operations to extract features and reduce the dimension of the image to obtain a feature map containing rich image texture information. Use a fully connected layer to further integrate these features to generate high-level semantic features for classification. This feature can effectively capture information such as edges, textures, and shapes in the image.

[0061] Step 4: Extract statistical features of bytecode files.

[0062] The bytecode file is traversed using the N-Gram algorithm to capture the contextual relationship between the bytecodes, and the hash vectorization algorithm is applied to map the N-Gram sequence to a fixed-size feature space to form a sparse matrix representation. Various statistics of the hash features, such as the mean, standard deviation, maximum, minimum, and sum, are calculated to obtain the aggregated statistical features of the bytecode file. These statistical features effectively reflect the local information in the bytecode file and convert it into a lower-dimensional and more expressive feature representation. At the same time, it also avoids the problem of insufficient memory caused by storing N-Gram features of a large number of bytecode files.

[0063] Step 5: Extract instruction sequence features.

[0064] Step 5.1: Extract instruction sequence: The .asm file contains assembly instructions, variable definitions, PE headers and their respective resources. This step only extracts the assembly instruction sequence. Analyze the .text header, build a regular expression based on the characteristics of the assembly instructions, and extract the instruction sequence of all .text headers in the file.

[0065] Step 5.2: Word embedding model: Since the instructions of each file are of different lengths, it is difficult to fix the length for subsequent classification. Therefore, natural language processing (NLP) technology is selected to embed the instruction sequence into a vector space of fixed dimension. First, all instructions are used as a vocabulary to train the word embedding model. Since the .asm file is too large and the instruction sequence is too long, it is easy to cause insufficient memory. Therefore, the instruction sequence of step 5.1 is simplified. For example, the details of the specific registers have little effect on the detection effect. For all registers eax, ebx, edx, etc., they are regarded as the word 'Restore'. After applying the set simplification rules, the simplified instruction sequence is finally obtained. Each instruction is regarded as a sentence, and the operation in the instruction is regarded as a word. The word vector (Word2Vec) embedding model is trained, which converts each word into a vector of fixed dimension. The vectors of each word in the entire instruction are aggregated, and the average value is taken as the feature vector of the entire instruction; all instruction vectors of the entire file are aggregated, and the average value is taken as the feature vector of the instruction sequence of the entire file.

[0066] Step 6: Classifier training.

[0067] The features of steps 3, 4, and 5 are weighted and spliced ​​to train the malicious code detection classifier. Bayesian optimization is used to automatically adjust the weight of each feature to find the optimal fusion combination and improve the classification performance of the model. Multi-layer dropout is set to randomly inactivate network nodes to reduce the risk of overfitting. The model parameters are adjusted through the back-propagation algorithm to increase the accuracy of classification, and cross-validation or is used to verify the performance of the classifier.

[0068] Step 7: Malicious code detection.

[0069] Perform steps 2, 3, and 4 on the bytecode files in the test set to extract multiple features. Use the .asm file as the input of step 5, and put the obtained assembly instruction sequence into the trained Word2vec model to obtain the instruction sequence features. Input all features into the trained classifier in step 6 to obtain the classification results.

[0070] Step 8: Evaluate and adjust parameters.

[0071] First, we use 10,868 malware from the Microsoft malware detection dataset to conduct a preliminary evaluation. The dataset contains nine different malware categories. We evaluate whether we can accurately classify these nine types of malicious code and determine the accuracy of the model detection. Secondly, we check the effectiveness of the detection. We use precision, recall and other evaluation indicators to evaluate each category and see whether we can accurately distinguish which malicious family it belongs to. Finally, we compare the different models used in each step, find the model with the best detection effect and save it for future detection.

[0072] Taking the collection of a large number of malicious PE files on the VirusShare website as an example, the technical solution of the present invention is described in detail through an embodiment:

[0073] Step (1): Dataset collection, as follows:

[0074] Collect a large number of malicious PE files on the VirusShare website. Call the Virus Total API, take the MD5 code of the PE file as input, query the family category of the file, select the category that is judged to be the most common in VirusTotal and mark it as the malware dataset. Collect a large number of installation packages and executable files on the Microsoft official website, and use them as the benign software dataset after VirusTotal judges them to be benign.

[0075] Read all the files obtained in step (1) sequentially, one byte at a time, convert the corresponding binary data into hexadecimal data, and obtain the .bytes bytecode file.

[0076] Put all the files obtained in step (1) into IDA Pro for analysis, and use IDA Python to disassemble them to obtain the corresponding .asm files. At this point, each PE file is converted into two files: a .bytes file and an assembly language source file (.asm file).

[0077] According to the annotations in step (1), each malware family category is randomly split to ensure that 90% of each category is used as a training set and 10% is used as a test set.

[0078] Step (2): Construct an RGB image for the bytecode file, as follows:

[0079] Determine the height H and width L of the image according to the size of each bytecode file, and initialize the H×L matrix. The range of each byte is between 0 and 255, which just corresponds to the pixel range of the grayscale image. Traverse the bytecode file, convert the hexadecimal data into decimal data, and fill the matrix in sequence as the pixel value of the matrix. If the matrix is ​​not filled after the file traversal is completed, fill the remaining positions with 0. Convert the matrix to an image, and use bilinear interpolation to scale the image to a uniform size as the first grayscale image.

[0080] The grayscale image obtained in step (2) is transformed using LBP to extract the texture features of the image. Each pixel in the image is traversed and the LBP value is calculated in the 3x3 neighborhood. If the pixel value in the neighborhood is greater than or equal to the value of the central pixel, the corresponding binary bit is 1, otherwise it is 0. These binary bits are sequentially combined into an 8-bit binary number and converted into a decimal number as the LBP value of the pixel, and finally an LBP image is generated. The LBP image is Fourier transformed to convert the image from the spatial domain to the frequency domain. A high-pass filter is created and point-by-point multiplication is performed on it with the spectrum of the LBP image to filter out the low-frequency part and retain only the high-frequency features. Then, the spectrum processed by the high-pass filter is inversely Fourier transformed and converted back to the spatial domain to obtain the LBP image processed by the high-pass filter, which strengthens the texture feature information of the LBP. Finally, the image is scaled using bilinear interpolation as the second grayscale image.

[0081] Convert the bytecode file to a decimal file. The decimal representation range of each byte is between 0 and 255. Therefore, a 256×256 matrix Arr is established. The decimal file is traversed from beginning to end to obtain the decimal value of the current position (CurrentNum) and the decimal value of the next position (NextNum). The value of Arr[CurrentNum][NextNum] is increased by 1. If the value exceeds 255, it is regarded as 255. Finally, it is converted into a grayscale image that reveals the frequent patterns in the data and the relationship between bytes. After bilinear interpolation and scaling, the third grayscale image is obtained.

[0082] The three grayscale images in step (2) are merged as red, green, and blue channels respectively to construct an RGB image.

[0083] Step (3): Extract RGB image features, as follows:

[0084] Build a VGG16 convolutional neural network, preload the pre-trained parameters in the ImageNet dataset, and use it as an RGB image feature extractor.

[0085] The RGB image in step (2) is input into the convolutional neural network. After multiple layers of convolution, pooling and activation, the features are flattened in the Flatten layer.

[0086] Step (4): Extract the statistical features of the bytecode file, as follows:

[0087] The bytecode file is traversed using the N-Gram algorithm to obtain an N-Gram bytecode sequence, where each N-Gram represents a local context relationship between bytecodes.

[0088] The N-Gram features are hashed by the hash vectorization algorithm, and each N-Gram sequence is mapped to a fixed-size feature space. The N-Gram sequence of each bytecode file is hashed to generate a sparse feature vector of uniform dimension, and the N-Gram features are converted into a fixed-length sparse matrix representation.

[0089] Calculate various statistical features of step (3): including the mean, standard deviation, maximum value, minimum value and sum of the hash features of the bytecode file, and finally obtain the statistical features of the same dimension of bytecode files of different sizes.

[0090] Step (5): Extract instruction sequence features, as follows:

[0091] Traverse the .asm file, locate the .text header, write a regular expression according to the instruction format of the assembly language, and filter to obtain all instruction sequences in the .text header.

[0092] Set the generalization rules of the instruction sequence, including the generalization of different registers, different immediate values, and different memory segment accesses, to focus more on the instruction sequence itself. Apply the generalization rules to the instruction sequence in step (1) to obtain the generalized instruction sequence, and use all instruction sequences as the vocabulary to train the Word2Vec model.

[0093] Input the instruction sequence in each .asm file into the Word2Vec model in step (5) in turn. For each instruction, treat the entire instruction as a sentence and each word as a word. Obtain the word embedding vector representation of each word in each sequence through the trained Word2Vec model. Average all words to obtain the embedding representation of each sequence. Next, average all the vectors of the instruction sequences extracted from the .asm file to obtain the embedding representation of the instruction sequence in the entire file, and use this vector as the instruction sequence feature.

[0094] Step (6): Malicious code detection and assessment, as follows:

[0095] Perform Bayesian weighted fusion on the three feature vectors from steps (3), (4), and (5). Assign weights to the three feature vectors . With the F1 score as the optimization target, a Bayesian optimization proxy model is set to optimize the feature weights. Each iteration adjusts the weight combination based on the performance of the model on the training set and updates it to the next optimal weight. The fused feature vector is input into a multi-layer fully connected layer, and after random inactivation by dropout, a trained classifier is obtained.

[0096] After the test set files are processed through steps (3), (4), and (5), they are put into the classifier for classification to obtain the final classification results.

[0097] The entire dataset contains nine malware families, with a total of 10,808 malware samples. 1,087 malicious samples are evenly selected from each family as the test set. After classification in step (2), the initial accuracy rate reaches 98%, and 1,070 malware can be correctly classified.

[0098] According to the training results of step (3), the model is continuously improved, model parameters and model types are changed, anomaly detection results are observed, the state with the best performance is found, and the training model is saved to complete the malicious code detection task.

[0099] In view of the above problems, the present invention proposes a malicious code detection method based on multi-level feature fusion. By converting the portable executable file (PE file) of the training set into a bytecode file (.bytes file) and an assembly language source file (.asm file), the macroscopic distribution, local texture features and byte sequence relationship of the bytecode file are extracted, including the grayscale image of the bytecode file, the LBP high-pass filter image and the front-back relationship image of the bytecode file, and further constructing an RGB image containing local and global image features. At the same time, the n-gram (N-Gram) feature is extracted, the N-Gram feature is processed, and the N-Gram feature is processed into a fixed-size feature vector using a hash vectorization algorithm, and the feature extraction and memory limitation problems of large-scale bytecode files are solved through batch processing, and the hash feature vector is further aggregated and statistically processed to obtain its statistical features, which can effectively summarize the local information in the bytecode file and convert it into a lower-dimensional and more expressive feature representation; the assembly instruction features in the .asm file are extracted, rules are set to generalize the assembly instructions and establish a vocabulary, and a word embedding model is trained to aggregate the sequence features in the file. By fusing three features, namely bytecode image, text and assembly instruction, with different weights, an efficient malicious code detection classifier is trained to achieve more accurate and efficient malicious code detection.

[0100] Embodiment 2

[0101] This embodiment provides a malicious code detection system based on multi-level feature fusion.

[0102] A malicious code detection system based on multi-level feature fusion, including:

[0103] A data acquisition module, configured to: acquire a bytecode file and an assembly language source file of a malicious file;

[0104] The RGB image feature extraction module is configured to: construct an RGB image based on the bytecode file, and extract the RGB image features;

[0105] A hash module is configured to: traverse the bytecode file to obtain N-Gram features; perform hash mapping on the N-Gram features to generate a sparse feature vector of a uniform dimension to obtain bytecode data statistical features;

[0106] A word embedding module is configured to: obtain instruction sequence features based on an assembly language source file using a word embedding model;

[0107] A fusion module is configured to: fuse RGB image features, bytecode data statistical features and instruction sequence features to obtain fusion features;

[0108] The detection module is configured to obtain a detection result by using a classifier based on fusion features.

[0109] In some embodiments, the RGB image feature extraction module is further configured to: map the decimal numbers corresponding to the bytecode file into a matrix in sequence, and obtain a first grayscale image after conversion; perform LBP transformation based on the first grayscale image, calculate the LBP value in a specified neighborhood, and obtain an LBP image; process the LBP image to obtain a second grayscale image; convert the bytecode file into a decimal file, traverse the decimal file, construct a matrix, and obtain a third grayscale image after conversion; combine the first grayscale image, the second grayscale image, and the third grayscale image to construct an RGB image.

[0110] In some embodiments, the RGB image feature extraction module is further configured to: fix the height and width of the matrix according to the size of the bytecode file, map the decimal numbers corresponding to the bytecode file into the matrix in sequence, convert the matrix into a grayscale image, and use a bilinear interpolation algorithm to reduce the grayscale image to a first grayscale image of a fixed size.

[0111] In some embodiments, the RGB image feature extraction module is further configured to: perform a local binary pattern transform on the first grayscale image, compare each pixel with its surrounding pixels, generate a binary number based on the comparison result, and convert it into a decimal number as a new pixel value to generate an LBP image; perform Fourier transform, high-pass filter processing and inverse Fourier transform on the LBP image in sequence to enhance the texture features of the LBP image; and scale the enhanced LBP image using bilinear interpolation to obtain a second grayscale image.

[0112] In some embodiments, the RGB image feature extraction module is further configured to: convert each byte in the bytecode file into decimal data to establish a 256×256 matrix; traverse the bytecode file in sequence, obtain two bytes each time, locate the position in the 256×256 matrix through the values ​​of the two bytes, increase the grayscale, and obtain a third grayscale image.

[0113] In some embodiments, the sparse feature vector includes: a hash mean feature, a hash standard deviation feature, a hash maximum feature, a hash minimum feature, and a hash sum feature.

[0114] In some embodiments, the word embedding module is further configured to: traverse the assembly language source file, locate the .text header, write a regular expression according to the instruction format of the assembly language, and obtain all instruction sequences in the .text header after screening; generalize all instruction sequences, input the generalized instruction sequences into the word embedding model, and obtain the word embedding vector representation of each word in each instruction sequence; average and aggregate the word embedding vector representations of all words to obtain the instruction sequence characteristics of the assembly language source file.

[0115] In some embodiments, the fusion module is further configured to: assign weights to the RGB image features, bytecode data statistical features, and instruction sequence features respectively, perform Bayesian weighted fusion, and obtain fused features.

[0116] The detection process of the present invention is divided into two processes: training stage and testing stage. In the training stage, the PE files of the training set are converted into bytecode files and asm files, the macroscopic distribution, local texture features, and sequence relationships between bytes of the bytecode files are extracted, and an RGB image containing local and global features of the image is constructed to reflect the complex relationship of the bytecode file data at the image level; the N-Gram features of the bytecode files are extracted, the N-Gram features are hash mapped, and the statistical features such as the mean and sum of the hash mapping matrix are calculated to obtain the complex relationship of the bytecode file data at the text level; the assembly instruction features in the asm file are extracted, generalized, a vocabulary is established, a word embedding model is trained, and the sequence features in the entire file are aggregated in a word embedding manner. The above three features are summarized to train a malicious code detection classifier. Testing stage: the PE files of the test set are preprocessed, the corresponding features are extracted using the three trained feature extractors, and the classification results are obtained through the classifier. The three grayscale images generated at the same time can be used as a reference for security experts to locate the key areas of malicious code.

[0117] Embodiment 3

[0118] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps in the malicious code detection method based on multi-level feature fusion as described in the first embodiment are implemented.

[0119] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0120] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0121] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0122] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0123] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0124] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A malicious code detection method based on multi-level feature fusion, characterized in that: include: Get the bytecode file and assembly language source file of the malicious file; Based on the bytecode file, construct an RGB image and extract the RGB image features; The method for constructing an RGB image based on a bytecode file includes: sequentially mapping decimal numbers corresponding to the bytecode file into a matrix, and obtaining a first grayscale image through conversion; performing an LBP transformation based on the first grayscale image, calculating an LBP value in a specified neighborhood, and obtaining an LBP image; processing the LBP image, and obtaining a second grayscale image; converting the bytecode file into a decimal file, traversing the decimal file, constructing a matrix, and obtaining a third grayscale image through conversion; and combining the first grayscale image, the second grayscale image, and the third grayscale image to construct an RGB image; The method of mapping the decimal numbers corresponding to the bytecode file into a matrix and converting the decimal numbers into a first grayscale image comprises: fixing the height and width of the matrix according to the size of the bytecode file, mapping the decimal numbers corresponding to the bytecode file into the matrix, converting the matrix into a grayscale image, and reducing the grayscale image into a first grayscale image of a fixed size by using a bilinear interpolation algorithm; Based on the first grayscale image, LBP transformation is performed, and the LBP value in the specified neighborhood is calculated to obtain the LBP image; the method for processing the LBP image to obtain the second grayscale image includes: using local binary pattern transformation on the first grayscale image, comparing each pixel with the pixels around it, generating a binary number according to the comparison result, and converting it into a decimal number as a new pixel value to generate the LBP image; performing Fourier transformation, high-pass filter processing and inverse Fourier transformation on the LBP image in sequence to enhance the texture features of the LBP image; and scaling the enhanced LBP image by bilinear interpolation to obtain the second grayscale image; The method of converting a bytecode file into a decimal file, traversing the decimal file, constructing a matrix, and obtaining a third grayscale image after conversion includes: converting each byte in the bytecode file into decimal data to establish a 256×256 matrix; traversing the bytecode file in sequence, sequentially obtaining two bytes each time, locating the position in the 256×256 matrix by the values ​​of the two bytes, increasing the grayscale, and obtaining a third grayscale image; Traverse the bytecode file to obtain N-Gram features; perform hash mapping on the N-Gram features to generate sparse feature vectors of uniform dimensions to obtain bytecode data statistical features; A method for obtaining instruction sequence features based on an assembly language source file and using a word embedding model includes: traversing the assembly language source file, locating a .text header, writing a regular expression according to the instruction format of the assembly language, and obtaining all instruction sequences in the .text header after screening; generalizing all instruction sequences, inputting the generalized instruction sequences into a word embedding model, and obtaining a word embedding vector representation of each word in each instruction sequence; averaging and aggregating the word embedding vector representations of all words to obtain instruction sequence features of the assembly language source file; The RGB image features, bytecode data statistical features and instruction sequence features are fused to obtain fused features; Based on the fusion features, a classifier is used to obtain the detection results.

2. The malicious code detection method based on multi-level feature fusion according to claim 1 is characterized in that: The sparse feature vector includes: a hash mean feature, a hash standard deviation feature, a hash maximum feature, a hash minimum feature and a hash sum feature.

3. The malicious code detection method based on multi-level feature fusion according to claim 1 is characterized in that: The RGB image features, bytecode data statistical features and instruction sequence features are fused to obtain fused features; the method includes: assigning weights to the RGB image features, bytecode data statistical features and instruction sequence features respectively, performing Bayesian weighted fusion, and obtaining fused features.

4. The malicious code detection system based on multi-level feature fusion is characterized by: include: A data acquisition module, configured to: acquire a bytecode file and an assembly language source file of a malicious file; The RGB image feature extraction module is configured to: construct an RGB image based on the bytecode file, and extract the RGB image features; The method for constructing an RGB image based on a bytecode file includes: sequentially mapping decimal numbers corresponding to the bytecode file into a matrix, and obtaining a first grayscale image through conversion; performing an LBP transformation based on the first grayscale image, calculating an LBP value in a specified neighborhood, and obtaining an LBP image; processing the LBP image, and obtaining a second grayscale image; converting the bytecode file into a decimal file, traversing the decimal file, constructing a matrix, and obtaining a third grayscale image through conversion; and combining the first grayscale image, the second grayscale image, and the third grayscale image to construct an RGB image; The method of mapping the decimal numbers corresponding to the bytecode file into a matrix and converting the decimal numbers into a first grayscale image comprises: fixing the height and width of the matrix according to the size of the bytecode file, mapping the decimal numbers corresponding to the bytecode file into the matrix, converting the matrix into a grayscale image, and reducing the grayscale image into a first grayscale image of a fixed size by using a bilinear interpolation algorithm; Based on the first grayscale image, LBP transformation is performed, and the LBP value in the specified neighborhood is calculated to obtain the LBP image; the method for processing the LBP image to obtain the second grayscale image includes: using local binary pattern transformation on the first grayscale image, comparing each pixel with the pixels around it, generating a binary number according to the comparison result, and converting it into a decimal number as a new pixel value to generate the LBP image; performing Fourier transformation, high-pass filter processing and inverse Fourier transformation on the LBP image in sequence to enhance the texture features of the LBP image; and scaling the enhanced LBP image by bilinear interpolation to obtain the second grayscale image; The method of converting a bytecode file into a decimal file, traversing the decimal file, constructing a matrix, and obtaining a third grayscale image after conversion includes: converting each byte in the bytecode file into decimal data to establish a 256×256 matrix; traversing the bytecode file in sequence, sequentially obtaining two bytes each time, locating the position in the 256×256 matrix by the values ​​of the two bytes, increasing the grayscale, and obtaining a third grayscale image; A hash module is configured to: traverse the bytecode file to obtain N-Gram features; perform hash mapping on the N-Gram features to generate a sparse feature vector of a uniform dimension to obtain bytecode data statistical features; The word embedding module is configured as follows: based on the assembly language source file, using the word embedding model, the method for obtaining the instruction sequence features includes: traversing the assembly language source file, locating the .text header, writing a regular expression according to the instruction format of the assembly language, and obtaining all the instruction sequences in the .text header after screening; generalizing all the instruction sequences, inputting the generalized instruction sequences into the word embedding model, and obtaining the word embedding vector representation of each word in each instruction sequence; averaging and aggregating the word embedding vector representations of all the words to obtain the instruction sequence features of the assembly language source file; A fusion module is configured to: fuse RGB image features, bytecode data statistical features and instruction sequence features to obtain fusion features; The detection module is configured to obtain a detection result by using a classifier based on fusion features.

5. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps in the malicious code detection method based on multi-level feature fusion as described in any one of claims 1-3 are implemented.

Images