Malicious code classification method and device and storage medium

Abstract

The invention discloses a malicious code classification method and device and a storage medium. The classification method comprises the following steps: forming a byte stream by using a binary file of a malicious code according to 8 bits as a group, converting each byte into a decimal unsigned integer, arranging the decimal unsigned integer into at least one two-dimensional matrix, and generating a grayscale image by each two-dimensional matrix; the byte stream is segmented into at least one byte segment, each byte segment serves as a Markov chain to generate a Markov transition probability matrix, and a corresponding Markov image is generated through the matrix; the grayscale images and the Markov images are paired one by one and then serve as dual-channel images of the same malicious code snippet; and inputting the dual-channel image of each malicious code snippet into a trained neural network-based malicious code dual-channel image multi-classification model for classification prediction to obtain a malicious code type prediction result. According to the scheme, the malicious code classification accuracy and efficiency can be improved, and the recognition capability of unknown and variant malicious codes is enhanced.

Description

Technical Field

[0001] The present invention relates to network security technology, and in particular to a classification method, device and storage medium for malicious code. Background Art

[0002] Malicious code is a harmful computer code that is used as a carrier of attack and transmitted to the target through the Internet, mobile storage media, etc. Its design purpose is to create system vulnerabilities and cause backdoors, security risks, information and data theft, and other potential damage to files and computer systems. Malicious code not only causes huge economic losses to enterprises and users, but also poses a serious threat to national security.

[0003] Traditional malicious code classification methods mainly rely on static analysis or dynamic analysis to obtain features, and then apply machine learning algorithms for classification. Static analysis deconstructs the code to understand its logic and capture structural features, but its effectiveness is reduced when facing unknown or slightly mutated malicious code. Dynamic analysis runs the code in a controlled execution environment and observes its behavior, such as network communication and file operations. Although it can reveal runtime behavior, it also brings additional performance burden and security risks. As malicious codes adopt more advanced obfuscation, polymorphism, and packing technologies, they can generate a large number of variants and even execute in the system kernel, making them difficult to detect and easily bypassing traditional security lines. Summary of the invention

[0004] The present application embodiment provides a method for classifying malicious code, including: The binary file of the malicious code forms a byte stream according to a group of 8 bits, converts the binary number of each byte in the byte stream into a decimal unsigned integer, arranges the converted byte stream byte by byte and row by row into at least one two-dimensional matrix of a preset size, and generates a corresponding grayscale image from each two-dimensional matrix; divides the byte stream into at least one byte segment, uses each byte segment as a Markov chain to generate a corresponding Markov transition probability matrix, and generates a corresponding Markov image from each Markov transition probability matrix; According to the positional relationship between the two-dimensional matrix and the byte fragment in the byte stream, the grayscale image generated by the two-dimensional matrix and the Markov image generated by the byte fragment are paired one by one, and the two paired images are used as dual-channel images of the same malicious code fragment; The dual-channel image of each malicious code fragment is input into a trained neural network-based malicious code dual-channel image multi-classification model for classification prediction to obtain a malicious code type prediction result corresponding to the malicious code fragment.

[0005] An embodiment of the present application provides a malicious code classification device, including: a memory and a processor, the memory stores a computer program, and the computer program implements the steps of the above-mentioned malicious code classification method when executed by the processor.

[0006] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which implements the steps of the above-mentioned malicious code classification method when executed by a processor.

[0007] The malicious code classification method and device provided in the embodiment of the present application converts the binary file of the malicious code into a grayscale image and a Markov image at the same time, and pairs the grayscale image with the Markov image one by one, and the two paired images are used as the dual-channel image of the same malicious code fragment; the dual-channel image of each malicious code fragment is input into the trained malicious code dual-channel image multi-classification model based on a neural network for classification prediction, and the malicious code type prediction result corresponding to the malicious code fragment is obtained. The method provided in the above embodiment can improve the accuracy and efficiency of malicious code classification and enhance the recognition ability of unknown and variant malicious codes.

[0008] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by implementing the present application. Other advantages of the present application can be realized and obtained by the schemes described in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The accompanying drawings are used to provide an understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.

[0010] Figure 1 A flowchart of a malicious code classification method provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of a malicious code dual-channel image multi-classification model based on VGG16 provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a malicious code dual-channel image multi-classification model based on Swin-Transformer provided in an embodiment of the present application; Figure 4 A schematic diagram of the structure of a malicious code dual-channel image multi-classification model based on CoAtNet provided in an embodiment of the present application; Figure 5 A schematic diagram of the structure of a malicious code dual-channel image multi-classification model based on ConvNeXt provided in an embodiment of the present application; Figure 6 A flowchart of a malicious code classification method based on dual-channel images and ensemble learning provided in an embodiment of the present application; Figure 7 A schematic diagram of the structure of a malicious code classification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The present application describes multiple embodiments, but the description is exemplary rather than restrictive, and it is obvious to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described in the present application. Although many possible feature combinations are shown in the drawings and discussed in the specific embodiments, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with any other feature or element in any other embodiment, or may replace any other feature or element in any other embodiment.

[0012] The present application includes and contemplates combinations of features and elements known to those of ordinary skill in the art. The embodiments, features and elements disclosed in the present application may also be combined with any conventional features or elements to form a unique invention scheme. Any features or elements of any embodiment may also be combined with features or elements from other invention schemes to form another unique invention scheme. Therefore, it should be understood that any feature shown and / or discussed in the present application may be implemented individually or in any appropriate combination. Therefore, except for the limitations made according to the attached claims and their equivalents, the embodiments are not subject to other restrictions. In addition, various modifications and changes may be made within the scope of protection of the attached claims.

[0013] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not rely on the specific order of the steps described herein, the method or process should not be limited to the steps of the specific order described. As will be understood by those of ordinary skill in the art, other sequences of steps are also possible. Therefore, the specific sequence of the steps set forth in the specification should not be interpreted as a limitation to the claims. In addition, the claims for the method and / or process should not be limited to the steps of performing them in the order written, and those skilled in the art can easily understand that these sequences can be changed and still remain within the spirit and scope of the embodiments of the present application.

[0014] like Figure 1 As shown, the embodiment of the present disclosure provides a method for classifying malicious code, including: Step S10, forming a byte stream of a binary file of the malicious code into a group of 8 bits, converting the binary number of each byte in the byte stream into a decimal unsigned integer, arranging the converted byte stream byte by byte and row by row into at least one two-dimensional matrix of a preset size, and generating a corresponding grayscale image from each two-dimensional matrix; dividing the byte stream into at least one byte segment, taking each byte segment as a Markov chain to generate a corresponding Markov transition probability matrix, and generating a corresponding Markov image from each Markov transition probability matrix; Step S20, pairing the grayscale image generated by the two-dimensional matrix with the Markov image generated by the byte fragment one by one according to the positional relationship between the two-dimensional matrix and the byte fragment in the byte stream, and using the two paired images as dual-channel images of the same malicious code fragment; Step S30, inputting the dual-channel image of each malicious code fragment into a trained neural network-based malicious code dual-channel image multi-classification model for classification prediction, and obtaining a malicious code type prediction result corresponding to the malicious code fragment.

[0015] The malicious code classification method provided in the above embodiment forms a byte stream of a binary file of the malicious code according to a group of 8 bits, converts the binary number of each byte in the byte stream into a decimal unsigned integer, arranges the converted byte stream byte by byte and row by row into at least one two-dimensional matrix of a preset size, and generates a corresponding grayscale image from each two-dimensional matrix; divides the byte stream into at least one byte segment, and uses each byte segment as a Markov chain to generate a corresponding Markov transition probability matrix, and generates a corresponding Markov image from each Markov transition probability matrix; according to the positional relationship between the two-dimensional matrix and the byte segment in the byte stream, the grayscale image generated by the two-dimensional matrix and the Markov image generated by the byte segment are paired one by one, and the two paired images are used as the dual-channel image of the same malicious code segment; the dual-channel image of each malicious code segment is input into a trained malicious code dual-channel image multi-classification model based on a neural network for classification prediction, and the malicious code type prediction result corresponding to the malicious code segment is obtained. The method provided in the above embodiment can improve the accuracy and efficiency of malicious code classification and enhance the recognition ability of unknown and variant malicious codes.

[0016] Grayscale images can well display the original information and structural information of binary files, but they have certain redundancy. The Markov image converted from the binary file according to the transfer probability between bytes contains the distribution characteristics of the binary file, which can enhance the representation of information to a certain extent. It can be seen that the two images each represent different aspects of the binary file and have the complementarity of malicious code feature information. The method of the embodiment of the present application converts the binary file of the malicious code into a grayscale image and a Markov image at the same time, and compares them one by one in pairs, ensuring that the two images represent the original binary code of the same part. The grayscale image and the Markov image form a dual-channel image, which can not only more completely represent the original information of the binary file of the malicious code, but also enable the subsequent neural network classification model to extract more complementary and more sufficient feature information, thereby improving the accuracy and efficiency of malicious code classification prediction and enhancing the recognition ability of unknown and variant malicious codes.

[0017] In an exemplary embodiment, the binary file includes a binary file in a PE (Portable Executable) format. Common EXE, DLL, OCX, SYS, and COM are all PE files.

[0018] The binary file of the malicious code is formed into a byte stream according to 8 bits. , and then convert each 8-bit byte B to a decimal unsigned integer with a value between 0 and 255.

[0019] For example, the binary code fragment is 010011101010001111001100. First, the byte stream fragments 01001110, 10100011, 11001100 are formed according to 8-bit groups. Then, the binary number of each byte is converted into a decimal unsigned integer to obtain the converted byte stream fragment 78, 163, 204. In the above way, the original binary malicious code fragment is converted into a one-dimensional vector composed of decimal unsigned integers. By setting the width, the one-dimensional vector can be reorganized into a two-dimensional matrix with a certain width.

[0020] In an exemplary embodiment, the converted byte stream is arranged byte by byte and row by row into at least one two-dimensional matrix of a preset size, and a corresponding grayscale image is generated from each two-dimensional matrix, including: Arrange the converted byte stream byte by byte and row by row into at least one two-dimensional matrix of size 256*256; Map each two-dimensional matrix to a corresponding grayscale image: use the value of the element in the i-th row and j-th column of each two-dimensional matrix as the grayscale value of the pixel in the i-th row and j-th column of the corresponding grayscale image; where, , .

[0021] Directly generating grayscale images from binary files (such as PE files) can avoid information loss caused by the decompilation process and fully characterize the original basic features of the malicious code. However, the direct generation of grayscale images may lose semantic information and contextual information, especially at the byte level. Since most of the new unknown malicious codes currently come from known malicious codes with minimal code differences, malicious codes in the same family also have great similarities in byte distribution patterns. To this end, consider converting the original binary file into a Markov image that can highlight the distribution characteristics of the malicious code. The binary file of the malicious code is formed into a byte stream in groups of 8 bits. Assuming that the value of each byte in the byte stream is a random variable and is only related to the value of the previous byte, the values ​​of all bytes in the byte stream can be regarded as a Markov chain; since the value of each byte is in the range of 0 to 255, there are 256 possible values ​​(states), based on the transition probability of each state A Markov transition probability matrix of size 256*256 can be generated, where , .

[0022] In an exemplary embodiment, the byte stream is divided into at least one byte segment, each byte segment is used as a Markov chain to generate a corresponding Markov transition probability matrix, and each Markov transition probability matrix is ​​used to generate a corresponding Markov image, including: The byte stream +1 byte to 65536th +1 byte as the k-th byte fragment; among them, ; For any byte segment, a sliding window with a width of two bytes is set, and the sliding window is slid backward from the first byte of the byte segment in a step of one byte until the last two bytes are included. After each sliding of the window, the value m of the previous byte and the value n of the next byte in the sliding window are recorded; wherein, , ; Statistics are collected for the 65536 records obtained by sliding the window, and 256 values ​​m from 0 to 255 are traversed. For any value m, the number of times the value m of the previous byte in the 65536 records is transferred to the value n of the next byte is counted. , according to the statistical results, determine the transition probability of the value m to any value n , The following formula 1 is used for calculation; (1) The probability of transferring from 256 values ​​m to 256 values ​​n The data generates a 256*256 Markov transition probability matrix, where the value of the element in the i-th row and j-th column of the Markov transition probability matrix is ​​the transition probability of the value i being transferred to the value j. ;in, , ; Map each Markov transition probability matrix to the corresponding Markov image: Map the value of the element in the i-th row and j-th column of each Markov transition probability matrix The pixel value of the pixel in the i-th row and j-th column of the corresponding Markov image is magnified by a preset multiple and rounded to an integer; wherein, , .

[0023] In an exemplary embodiment, the value of the element in the i-th row and j-th column of the Markov transition probability matrix is After enlarging the preset multiple a and rounding down, it becomes , The following formula 2 is used for calculation; (2) Where a is an integer, ; Is the rounding down symbol. By amplifying and integerizing the values ​​of the Markov transition probability matrix, the decimal matrix is ​​converted into an integer matrix, which is convenient for the computer to perform numerical operations and improve the operation efficiency.

[0024] In an exemplary embodiment, the grayscale image generated by the two-dimensional matrix and the Markov image generated by the byte fragment are paired one by one according to the positional relationship between the two-dimensional matrix and the byte fragment in the byte stream, and the two paired images are used as dual-channel images of the same malicious code fragment, including: Will contain the byte stream +1 byte to 65536th The grayscale image generated by the two-dimensional matrix of bytes of information is the same as the grayscale image generated by the two-dimensional matrix of bytes of information +1 byte to 65536th +1 byte information byte fragment generated Markov image is paired one by one, and the two paired images are used as the dual-channel image of the kth malicious code fragment; .

[0025] For example, a grayscale image generated by a two-dimensional matrix containing information from the 1st byte to the 65536th byte of the byte stream is paired with a Markov image generated by a byte segment containing information from the 1st byte to the 65536+1st byte of the byte stream, and the two paired images are used as the dual-channel image of the 0th malicious code segment. +1 byte to 65536th The grayscale image generated by the two-dimensional matrix of bytes of information is the same as the grayscale image generated by the two-dimensional matrix of bytes of information +1 byte to 65536th The Markov images generated by the byte segments of +1 byte information are paired one by one, and the two paired images are used as the dual-channel images of the first malicious code segment. +1 byte to 65536th The grayscale image generated by the two-dimensional matrix of bytes of information is the same as the grayscale image generated by the two-dimensional matrix of bytes of information +1 byte to 65536th The Markov images generated by the byte fragments of +1 byte information are paired one by one, and the two paired images are used as the dual-channel images of the second malicious code fragment. And so on. The grayscale images and Markov images generated in the order of binary codes are paired one by one to form dual-channel images, ensuring that the two images represent the same part of the original binary code. Such a set of dual-channel images can not only retain the complete information characteristics of the original malicious code, but also represent the corresponding byte structure and byte distribution characteristics, which is conducive to improving the accuracy of the subsequent multi-classification model.

[0026] In an exemplary embodiment, the method further includes: establishing at least one malicious code dual-channel image multi-classification model based on a neural network.

[0027] In an exemplary embodiment, the neural network-based malicious code dual-channel image multi-classification model includes at least one of the following: a malicious code dual-channel image multi-classification model based on VGG16, a malicious code dual-channel image multi-classification model based on Swin-Transformer, a malicious code dual-channel image multi-classification model based on EfficientNet-B0, a malicious code dual-channel image multi-classification model based on CoAtNet, and a malicious code dual-channel image multi-classification model based on ConvNeXt.

[0028] Figure 2 FIG. 4 shows a schematic diagram of the structure of a VGG16-based malicious code dual-channel image multi-classification model (denoted as Mal-VGG). Figure 2As shown in Figure 1, the input layer of the Mal-VGG model receives a dual-channel image of malicious code with a size of 256×256. The Mal-VGG model includes 5 convolution blocks. The first two convolution blocks each contain two convolution layers and one pooling layer. The last three convolution blocks each contain 3 convolution layers and one pooling layer. Each convolution layer can be The convolution kernel is , and the pooling layer is the maximum pooling layer. After passing through five convolution blocks, the feature map is flattened into a 32768-dimensional vector and input into two fully connected layers. The first fully connected layer has 1024 neurons, and the number of neurons in the last fully connected layer is consistent with the number of categories in the malicious code classification task. The Mal-VGG model has fewer fully connected layers and a lower output size than the traditional VGG16 model. Therefore, the time and space consumption of the Mal-VGG model training process is much smaller than that of the traditional VGG16 model.

[0029] Figure 3 FIG. 4 shows a schematic diagram of the structure of a dual-channel image multi-classification model of malicious code based on Swin-Transformer (denoted as Mal-SwinT). Figure 3 As shown in Figure 1, the core modules of the Mal-SwinT model include PatchPartition, Linear Embedding, Swin Transformer Block, and Patch Merging layers. PatchPartition divides the input image into 4×4 image blocks (Patches), each Patch contains an image of 2 channels, and the input image is divided into 64×64 Patches, totaling 4096 Patches. Linear Embedding linearly embeds each Patch and then maps it to a high-dimensional space through linear projection, that is, converts it into a 96-dimensional embedding vector. Swin Transformer Block (denoted as STB module) combines multi-head self-attention and multi-layer perceptron, and completes 4 times (corresponding to the attached) by stacking multiple STB modules. Figure 3Each STB module first normalizes the input features to improve training stability and convergence speed, then captures local and global dependencies through the Window based Multi-Head Self-Attention (W-MSA) module and the Shifted Window based Multi-Head Self-Attention (SW-MSA) module, and generates new feature representations. Finally, the two multi-layer perceptrons perform nonlinear changes on the features to improve the expressiveness of the model. The STB module realizes the effective extraction of multi-scale feature information of the image, enabling the model to gradually extract and transform the features of the image. Finally, the fully connected layer is used to reduce the dimension of the image features, output the category probability distribution, and realize the multi-classification task.

[0030] The EfficientNet model is an efficient convolutional neural network model designed based on neural architecture search technology. EfficientNetB0 is a variant in the EfficientNet series with good performance and efficiency. The embodiment of the present application designs a model for the dual-channel image multi-classification task of malicious code based on EfficientNet-B0. The network structure parameters of the malicious code dual-channel image multi-classification model based on EfficientNet-B0 (denoted as Mal-Effi) are shown in Table 1. As shown in Table 1, the components of the Mal-Effi model mainly include convolutional layers, MBConv modules, global average pooling layers, and fully connected layers. The MBConv module is the core module of the network, which uses the Swish activation function and adds a compression and activation module. The high-level features in the image are efficiently extracted through the 7-stage MBConv structure. The Mal-Effi model uses deep separable convolution to reduce the number of parameters and calculations, and enhances the feature extraction capability of the network through the squeeze-and-excitation (SE) module. The Swish activation function is a smooth non-monotonic activation function that can provide better training accuracy. Dropout and random depth methods are used in the MBConv structure to improve the regularization and generalization ability of the network.

[0031] Table 1

[0032] The CoAtNet model combines the advantages of convolutional neural networks and attention mechanisms. The embodiment of the present application designs a model for the dual-channel image multi-classification task of malicious code based on the CoAtNet model. Figure 4FIG. 4 shows a schematic diagram of the structure of a malicious code dual-channel image multi-classification model (denoted as Mal-CoAt) based on CoAtNet. Figure 4 As shown in the figure, the core components of the Mal-CoAt model mainly include convolutional layers, MBConv Block, self-attention, pooling layers, and fully connected layers. Deep convolution and self-attention can be unified through simple relative attention. By vertically stacking convolutional layers and attention layers in a reasonable way, the generalization ability and capacity of the model can be significantly improved. The Mal-CoAt model combines the advantages of convolutional neural networks and Transformers, with superior scalability and faster convergence speed.

[0033] The ConvNeXt model is a fully convolutional neural network structure, which draws on some ideas of the swin-transformer in its design while maintaining the high efficiency of the convolutional neural network. The embodiment of the present application designs a model for the dual-channel image multi-classification task of malicious code based on the ConvNeXt model. Figure 5 FIG. 4 shows a schematic diagram of the structure of a malicious code dual-channel image multi-classification model (denoted as Mal-ConvX) based on ConvNeXt. Figure 5 As shown in the figure, the Mal-ConvX model is constructed by standard ConvNet modules, mainly including convolutional layers, downsampling layers, ConvNeXt modules and fully connected layers. This model draws on the design of ResNeXt and improves performance by using deep separable convolution and increasing network depth. While maintaining accuracy, the ConvNeXt model also maintains the simplicity and efficiency of the standard convolutional network, making it more efficient in practical applications.

[0034] There are multiple types of malicious code datasets, and the number of samples in each type varies greatly. For example, in the widely used Malimg public dataset, the Allaple.A type has a total of 2,949 samples, while the Skintrim.N type has only 80 samples. Such severely unbalanced data will lead to low accuracy, poor robustness, and weak generalization of the trained model. In deep learning classification models, the simplest way to deal with unbalanced training sets is the resampling method. Undersampling is used to delete some samples from the excessive sample set, and oversampling is used to expand the data for the too few sample sets. For example, assuming that the training set of the Allaple.A type has 1,000 samples, undersampling can be performed to select 600 of them. However, for the Skintrim.N type, the amount of data is seriously insufficient, and the data needs to be expanded by oversampling until the training samples reach 600. At this time, since the number of training samples of the Allaple.A type is less than the total number of samples, the model is underfitting and cannot fully capture the potential patterns and features in the training data. However, the number of training samples of the Skintrim.N type is more than the total number of samples, and the model is overfitting. Therefore, the appropriate sample ratio is very important for model training.

[0035] In an exemplary embodiment, the method further includes: using multiple types of malicious code training data sets to train at least one malicious code dual-channel image multi-classification model based on a neural network.

[0036] In an exemplary embodiment, the method further includes: when training any neural network-based malicious code dual-channel image multi-classification model, determining the optimal solution for the sample ratio of different types of malicious code training sample data sets through evolutionary calculation.

[0037] In an exemplary embodiment, the evolutionary computing algorithm includes: ant colony optimization algorithm, particle swarm optimization algorithm and bat optimization algorithm. Evolutionary computing is a computing method influenced by the natural selection mechanism of "survival of the fittest" and the law of genetic information transmission in the biological evolution process. It simulates this process through program iteration, regards the problem to be solved as the environment, and seeks the optimal solution through natural evolution in a population composed of some possible solutions.

[0038] In an exemplary embodiment, after determining the optimal solution for the sample ratio of different types of malicious code training sample data sets through evolutionary computing, the method further includes: Determining the optimal number of samples of each malicious code training sample data set according to the optimal solution of the sample ratio of the different types of malicious code training sample data sets and the actual number of samples of the different types of malicious code training sample data sets; For a malicious code type whose actual training sample number is less than the optimal sample number of the malicious code training sample data set of this type, the number of malicious code training samples of this type is expanded through data enhancement processing.

[0039] In an exemplary embodiment, the data enhancement processing includes performing an image transformation on the dual-channel image.

[0040] In an exemplary embodiment, the image transformation includes at least one of the following: image rotation, image horizontal translation, image vertical translation, image horizontal flipping, image vertical flipping, image scaling, adjusting image brightness, and changing image tilt.

[0041] In an exemplary embodiment, the image transformation further comprises: after the image transformation changes the preset size of the image, cropping and padding the transformed image according to the preset size.

[0042] In an exemplary embodiment, filling the transformed image according to a preset size includes: filling the blank area by copying adjacent pixels.

[0043] In an exemplary embodiment, the different types of malicious code training sample data sets come from at least one of the following data sets: Malimg data set, BIG2015 data set, VXV data set and VirusShare data set.

[0044] In addition to the network structure, the diversity of training data distribution can effectively improve the upper limit of model performance. The Malimg dataset contains 9,339 real malicious code samples from 25 different categories, and the BIG2015 dataset contains 10,868 samples from 9 malicious code categories. The VXV dataset contains 16 malicious code categories and 6,398 PE files. The VirusShare dataset is also a large collection of malicious code category data, and its database is constantly being updated, which is conducive to continuous incremental learning and iterative optimization of malicious code classification models. The above training data meets the requirements of data diversity and large-scale quantity, which makes the malicious code dual-channel image multi-classification model based on neural network not prone to training overfitting problems while fitting the existing data distribution, and maintains good generalization for data distribution in different fields.

[0045] In an exemplary embodiment, the method further includes: using an Adam optimizer to train at least one malicious code dual-channel image multi-classification model based on a neural network.

[0046] Reasonable dataset construction needs to be combined with corresponding training strategies to maximize the capabilities of the neural network-based malicious code dual-channel image multi-classification model. During the training process, the Adam optimizer can be used for model training. The Adam optimizer is an optimization algorithm based on first-order moment estimation and second-order moment estimation. It combines the advantages of AdaGrad and RMSProp and is suitable for processing sparse gradients and large-scale data. In multi-classification tasks, the Softmax activation function is used to convert the model output into a probability distribution, and then the cross entropy loss function is calculated to measure the difference between the predicted value and the actual value.

[0047] In an exemplary embodiment, the dual-channel image of each malicious code fragment is input into a trained neural network-based malicious code dual-channel image multi-classification model for classification prediction, and a malicious code type prediction result corresponding to the malicious code fragment is obtained, including: When there is more than one trained neural network-based malicious code dual-channel image multi-classification model, the dual-channel image of each malicious code fragment is respectively input into multiple trained neural network-based malicious code dual-channel image multi-classification models for classification prediction, and the classification prediction result of each trained neural network-based malicious code dual-channel image multi-classification model for the malicious code fragment is obtained; The classification prediction results of multiple trained neural network-based malicious code dual-channel image multi-classification models are optimized through an integrated learning soft voting method, and the optimized classification prediction results are used as the final classification prediction results of the malicious code fragment.

[0048] In an exemplary embodiment, the classification prediction results of multiple trained neural network-based malicious code dual-channel image multi-classification models are optimized by an integrated learning soft voting method, including: The average value of the predicted probabilities of each malicious code type output by multiple trained neural network-based malicious code dual-channel image multi-classification models is calculated to obtain the average predicted probability value of each malicious code type, and the malicious code type with the largest average predicted probability value is taken as the final classification prediction result of the malicious code fragment.

[0049] For example, suppose there are three neural network-based malicious code dual-channel image multi-classification models, namely model 1, model 2, and model 3. Use the three models to classify and predict malicious code fragments. Model 1 outputs the predicted probabilities of three malicious code types (A, B, and C), which are: The predicted probability of a malicious code fragment belonging to malicious code type A is , the predicted probability that the malicious code fragment belongs to malicious code type B is , the predicted probability that the malicious code fragment belongs to the malicious code type C is Model 2 outputs the predicted probabilities of three malicious code types (A, B, and C), which are: The predicted probability that a malicious code fragment belongs to malicious code type A is , the predicted probability that the malicious code fragment belongs to malicious code type B is , the predicted probability that the malicious code fragment belongs to the malicious code type C is Model 3 outputs the predicted probabilities of three malicious code types (A, B, and C), which are: The predicted probability of a malicious code fragment belonging to malicious code type A is , the predicted probability that the malicious code fragment belongs to malicious code type B is , the predicted probability that the malicious code fragment belongs to the malicious code type C is .

[0050] The classification prediction results of three trained neural network-based malicious code dual-channel image multi-classification models are optimized through the ensemble learning soft voting method, including: calculating the average prediction probability of malicious code type A output by the three models, and obtaining the average prediction probability value of malicious code type A. . Calculate the average predicted probability of malicious code type B output by the three models to obtain the average predicted probability value of malicious code type B . Calculate the average predicted probability of malicious code type C output by the three models to obtain the average predicted probability value of malicious code type C Assumptions , the malicious code type A with the largest average prediction probability value is taken as the final classification prediction result of the malicious code fragment.

[0051] The ensemble learning soft voting method not only considers the prediction of each neural network-based malicious code dual-channel image multi-classification model, but also increases the stability and reliability of the prediction by probability averaging. It not only ensures the accuracy of the classification results, but also improves the generalization ability of the neural network-based malicious code dual-channel image multi-classification model for different types of malicious code images.

[0052] Figure 6 A flowchart of a malicious code classification method based on dual-channel images and ensemble learning is provided. Figure 6 As shown in the figure, the malicious code classification method based on dual-channel images and ensemble learning includes the following processing steps:

[0053] 1) Malicious code visualization The binary file of the malicious code forms a byte stream according to a group of 8 bits, converts the binary number of each byte in the byte stream into a decimal unsigned integer, arranges the converted byte stream byte by byte and row by row into at least one two-dimensional matrix of a preset size, and generates a corresponding grayscale image from each two-dimensional matrix; the byte stream is divided into at least one byte segment, and each byte segment is used as a Markov chain to generate a corresponding Markov transition probability matrix, and a corresponding Markov image is generated from each Markov transition probability matrix. The grayscale image generated by the two-dimensional matrix is ​​paired with the Markov image generated by the byte segment according to the positional relationship between the two-dimensional matrix and the byte segment in the byte stream, and the two paired images are used as dual-channel images of the same malicious code segment.

[0054] 2) Data balancing At least one malicious code dual-channel image multi-classification model based on a neural network is trained using multiple types of malicious code training data sets; when training any malicious code dual-channel image multi-classification model based on a neural network, an optimal solution for the sample ratio of different types of malicious code training sample data sets is determined by evolutionary calculation.

[0055] The optimal number of samples of each malicious code training sample data set is determined according to the optimal solution of the sample ratio of different types of malicious code training sample data sets and the actual number of samples of different types of malicious code training sample data sets; for a malicious code type whose actual number of training samples is less than the optimal number of samples of the malicious code training sample data set of this type, the number of malicious code training samples of this type is expanded through data enhancement processing.

[0056] 3) Use multiple trained neural network-based malicious code dual-channel image multi-classification models for classification prediction Five trained neural network-based malicious code dual-channel image multi-classification models are used to classify and predict at least one malicious code fragment. These five models are: malicious code dual-channel image multi-classification model based on VGG16, malicious code dual-channel image multi-classification model based on Swin-Transformer, malicious code dual-channel image multi-classification model based on EfficientNet-B0, malicious code dual-channel image multi-classification model based on CoAtNet, and malicious code dual-channel image multi-classification model based on ConvNeXt.

[0057] The dual-channel image of each malicious code fragment is respectively input into 5 trained malicious code dual-channel image multi-classification models based on neural network for classification prediction, and the classification prediction result of each trained malicious code dual-channel image multi-classification model based on neural network for the malicious code fragment is obtained.

[0058] 4) Ensemble Learning The classification prediction results of multiple trained neural network-based malicious code dual-channel image multi-classification models are optimized through an integrated learning soft voting method, and the optimized classification prediction results are used as the final classification prediction results of the malicious code fragments, and the malicious code categories are output, such as: Adialer.C, Skintrim.N, Rbot!gen, Gatak or Vundo, etc.

[0059] like Figure 7 As shown, an embodiment of the present application provides a malicious code classification device, including: a memory and a processor, the memory stores a computer program, and the computer program implements the steps of the above-mentioned malicious code classification method when executed by the processor.

[0060] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which implements the steps of the above-mentioned malicious code classification method when executed by a processor.

[0061] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or transient medium). As is known to those skilled in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0062] In addition, the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first", "second", etc. may explicitly or implicitly include at least one of the features.

[0063] In the description of the present application, “plurality” means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0064] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0065] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for classifying malicious code, comprising: The binary file of the malicious code forms a byte stream according to a group of 8 bits, converts the binary number of each byte in the byte stream into a decimal unsigned integer, arranges the converted byte stream byte by byte and row by row into at least one two-dimensional matrix of a preset size, and generates a corresponding grayscale image from each two-dimensional matrix; divides the byte stream into at least one byte segment, uses each byte segment as a Markov chain to generate a corresponding Markov transition probability matrix, and generates a corresponding Markov image from each Markov transition probability matrix; According to the positional relationship between the two-dimensional matrix and the byte fragment in the byte stream, the grayscale image generated by the two-dimensional matrix and the Markov image generated by the byte fragment are paired one by one, and the two paired images are used as dual-channel images of the same malicious code fragment; The dual-channel image of each malicious code fragment is input into a trained neural network-based malicious code dual-channel image multi-classification model for classification prediction to obtain a malicious code type prediction result corresponding to the malicious code fragment.

2. The method according to claim 1, characterized in that: According to the positional relationship between the two-dimensional matrix and the byte fragment in the byte stream, the grayscale image generated by the two-dimensional matrix and the Markov image generated by the byte fragment are paired one by one. The two paired images are used as dual-channel images of the same malicious code fragment, including: will contain the byte stream +1 byte to 65536th The grayscale image generated by the two-dimensional matrix of bytes of information is the same as the grayscale image generated by the two-dimensional matrix of bytes of information +1 byte to 65536th +1 byte information byte fragment generated Markov image is paired one by one, and the two paired images are used as the dual-channel image of the kth malicious code fragment; .

3. The method according to claim 2, characterized in that: Arranging the converted byte stream byte by byte and row by row into at least one two-dimensional matrix of a preset size, and generating a corresponding grayscale image from each two-dimensional matrix, including: Arrange the converted byte stream byte by byte and row by row into at least one two-dimensional matrix of size 256*256; Map each two-dimensional matrix to a corresponding grayscale image: use the value of the element in the i-th row and j-th column of each two-dimensional matrix as the grayscale value of the pixel in the i-th row and j-th column of the corresponding grayscale image; where, , .

4. The method according to claim 2, characterized in that: The byte stream is divided into at least one byte segment, each byte segment is used as a Markov chain to generate a corresponding Markov transition probability matrix, and each Markov transition probability matrix is ​​used to generate a corresponding Markov image, including: The byte stream +1 byte to 65536th +1 byte as the k-th byte fragment; among them, ; For any byte segment, a sliding window with a width of two bytes is set, and the sliding window is slid backward from the first byte of the byte segment in a step of one byte until the last two bytes are included. After each sliding of the window, the value m of the previous byte and the value n of the next byte in the sliding window are recorded; wherein, , ; Statistics are collected for the 65536 records obtained by sliding the window, and 256 values ​​m from 0 to 255 are traversed. For any value m, the number of times the value m of the previous byte in the 65536 records is transferred to the value n of the next byte is counted. , according to the statistical results, determine the transition probability of the value m to any value n , The following formula 1 is used for calculation; （1） The probability of transferring from 256 values ​​m to 256 values ​​n The data generates a 256*256 Markov transition probability matrix, where the value of the element in the i-th row and j-th column of the Markov transition probability matrix is ​​the transition probability of the value i being transferred to the value j. ;in, , ; Map each Markov transition probability matrix to the corresponding Markov image: Map the value of the element in the i-th row and j-th column of each Markov transition probability matrix The pixel value of the pixel in the i-th row and j-th column of the corresponding Markov image is magnified by a preset multiple and rounded to an integer; wherein, , .

5. The method according to claim 1, characterized in that The method further comprises: Establish at least one neural network-based dual-channel image multi-classification model for malicious code.

6. The method according to claim 5, characterized in that: The neural network-based malicious code dual-channel image multi-classification model includes at least one of the following: a malicious code dual-channel image multi-classification model based on VGG16, a malicious code dual-channel image multi-classification model based on Swin-Transformer, a malicious code dual-channel image multi-classification model based on EfficientNet-B0, a malicious code dual-channel image multi-classification model based on CoAtNet, and a malicious code dual-channel image multi-classification model based on ConvNeXt.

7. The method according to claim 5, characterized in that The method further comprises: Using multiple types of malicious code training data sets to train at least one malicious code dual-channel image multi-classification model based on a neural network; When training any neural network-based malicious code dual-channel image multi-classification model, the optimal solution for the sample ratio of different types of malicious code training sample data sets is determined through evolutionary calculation.

8. The method according to claim 7, characterized in that After determining the optimal solution for the sample ratio of different types of malicious code training sample data sets through evolutionary computing, the method further includes: Determining the optimal number of samples of each malicious code training sample data set according to the optimal solution of the sample ratio of the different types of malicious code training sample data sets and the actual number of samples of the different types of malicious code training sample data sets; For a malicious code type whose actual training sample number is less than the optimal sample number of the malicious code training sample data set of this type, the number of malicious code training samples of this type is expanded through data enhancement processing.

9. The method according to claim 8, characterized in that: The data enhancement processing includes performing image transformation on the dual-channel image; The image transformation includes at least one of the following: image rotation, image horizontal translation, image vertical translation, image horizontal flipping, image vertical flipping, image scaling, adjusting image brightness, and changing image tilt.

10. The method according to claim 1, characterized in that: Input the dual-channel image of each malicious code fragment into the trained neural network-based malicious code dual-channel image multi-classification model for classification prediction, and obtain the malicious code type prediction result corresponding to the malicious code fragment, including: When there is more than one trained neural network-based malicious code dual-channel image multi-classification model, the dual-channel image of each malicious code fragment is respectively input into multiple trained neural network-based malicious code dual-channel image multi-classification models for classification prediction, and the classification prediction result of each trained neural network-based malicious code dual-channel image multi-classification model for the malicious code fragment is obtained; The classification prediction results of multiple trained neural network-based malicious code dual-channel image multi-classification models are optimized through an integrated learning soft voting method, and the optimized classification prediction results are used as the final classification prediction results of the malicious code fragment.

11. The method according to claim 1, characterized in that: The binary file includes a binary file in a portable executable file PE format.

12. A malicious code classification device, comprising: A memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the malicious code classification method described in any one of claims 1 to 11 are implemented.

13. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the steps of the malicious code classification method according to any one of claims 1 to 11 are implemented.

Images