Malicious code classification method based on Hash function and FPN-Transformer

Abstract

The present invention relates to a malicious code classification method based on a hash function and an FPN-Transformer. The method uses a hash function to compress the code file data to be classified, thereby reducing the dimension of the feature data and reducing noise. The method combines a feature pyramid network (FPN) with a Transformer model to construct an FPN-Transformer model, providing multi-level and multi-perspective feature data for a multi-layer regression feature extraction model. The method utilizes the multi-layer regression feature extraction model to synthesize and fuse the features of different levels extracted by the FPN-Transformer model, and outputs a final code classification result based on the fusion result. The method significantly improves the performance and practicality of malicious code classification tasks through effective compression and efficient extraction of data features. The method also optimizes the accuracy and generalization ability of the model in practical applications by performing feature fusion and classification using an autocorrelation matrix classifier.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a malicious code classification method based on a Hash function and an FPN-Transformer. Background Art

[0002] Malware family classification is typically performed by monitoring network activity and analyzing malware behavioral characteristics. These classification methods serve a specific purpose: analyzing malware activity patterns and attack strategies in different network environments. Many malware families exhibit similar attack signatures, but their behaviors are not identical, exhibiting variations. These signatures may indicate specific attack intent or malicious activities, such as data theft, system sabotage, or other security threats. Therefore, accurately identifying and classifying these malware family signatures is crucial for improving the effectiveness of network security measures.

[0003] The sample size of malicious code is enormous and is growing explosively. While early rule- and signature-based classification methods have made some progress, they suffer from slow model updates and high false positive rates. With the development of machine learning technology, especially the introduction of deep learning models, significant progress has been made in malicious code detection and classification. However, traditional deep learning methods often rely on large amounts of high-quality labeled data when processing malicious code and are susceptible to "neural network model collapse" or "overfitting," which in practical applications reduces the generalization ability and practicality of classification models. Existing classification methods often face problems such as insufficient feature extraction and high resource consumption when processing large-scale datasets when dealing with complex and changing malicious code families. Summary of the Invention

[0004] The technical problem of the present invention is that the existing malicious code classification method based on deep learning network relies on high-quality data and is susceptible to neural network model collapse or overfitting, resulting in a decrease in model generalization ability and practicality, especially when processing large-scale or low-quality data sets, facing the problems of high resource consumption and insufficient accuracy.

[0005] The purpose of this invention is to address the above-mentioned problems and provide a malicious code classification method based on hash functions and FPN-Transformer. This method reduces the dependence on high-quality data by improving data preprocessing and feature extraction mechanisms, and optimizes feature expression and classification efficiency by combining Feature Pyramid Networks (FPN) with the Transformer model, thereby improving the accuracy and generalization ability of the model.

[0006] In order to achieve the above object, the technical solution provided by the present invention is:

[0007] A malicious code classification method based on hash function and FPN-Transformer uses hash function to compress the code file data to be classified, reducing the dimension of feature data and reducing noise; combines the feature pyramid network FPN and Transformer model to construct an FPN-Transformer model, providing multi-level and multi-perspective feature data for the multi-layer regression feature extraction model; uses the multi-layer regression feature extraction model to integrate and fuse the features of different levels extracted by the FPN-Transformer model, and outputs the final code classification result based on the fusion result.

[0008] The malicious code family classification method comprises the following steps:

[0009] Step 1: Data preprocessing: using a natural language processing model to extract preliminary feature data from the code files or code assemblies to be classified, capturing the semantic and structural information of the code;

[0010] Step 2: Perform hash random compression on the feature data obtained in step 1 to reduce the dimension of the feature data and reduce noise;

[0011] Step 2.1: Use the hash function to map the preprocessed feature values ​​to the hash function space;

[0012] Step 2.2: Filter important features based on the preset threshold and reduce the influence of irrelevant features;

[0013] Step 3: Use the FPN-Transformer model to perform in-depth analysis and feature extraction on the compressed feature data;

[0014] Step 4: The feature data obtained in step 3 is further fused and classified through a multi-layer regression feature extraction model;

[0015] Step 5: Based on the output results of the multi-layer regression feature extraction model, determine whether there is malicious code in the code file, and obtain the malicious code family to which the malicious code belongs.

[0016] Preferably, the code of the code file or code assembly to be classified is in binary or script format.

[0017] Preferably, in step 1, the natural language processing model is a CodeBERT model.

[0018] Preferably, the FPN-Transformer model specifically includes multiple average pooling layers, M encoders and M decoders, where M is the number of encoders. The encoder includes an input embedding layer, a multi-head attention unit, a normalization layer, a feedforward neural network and a normalization layer connected in sequence, and the structure of the decoder is the same as that of the encoder; the multi-head attention unit and the feedforward neural network with a self-attention mechanism are used for feature conversion and enhancement.

[0019] Preferably, the multi-layer regression feature extraction model specifically includes a parallel channel attention module and a spatial attention module, a linear layer and a regression layer, and an autocorrelation matrix classifier. The channel attention module includes an input embedding layer, a parallel average pooling layer and a maximum pooling layer, and a shared multi-layer perceptron; the spatial attention module includes an input embedding layer, a parallel average pooling layer and a maximum pooling layer, and a convolutional layer. The channel attention module and the spatial attention module are combined with the linear layer and the regression layer to capture the multi-scale information of the malicious code features. The shared multi-layer perceptron of the channel attention module is combined with the regression layer to enhance the richness and robustness of the feature expression. The autocorrelation matrix classifier uses the autocorrelation matrix to evaluate and strengthen the relationship between classification features, optimizes the feature combination through autocorrelation, and improves the accuracy and robustness of classification.

[0020] Furthermore, in step 1, important features are obtained by screening according to a preset threshold, and the dimension size of the hash function space and the threshold for feature screening are dynamically adjusted according to the needs of the FPN-Transformer model.

[0021] The present invention also provides a malicious code classification system corresponding to the malicious code classification method, comprising:

[0022] Data input module: receives code files or code assembly as input;

[0023] Data preprocessing module: preprocesses the code data obtained by the data input module, including feature extraction, data cleaning, standardization / normalization and feature selection, to ensure the quality and consistency of the input data, and outputs the preprocessed feature data to the Hash random compression module;

[0024] Hash random compression module: uses the hash algorithm to randomly map and compress the pre-processed feature data into the hash space;

[0025] Feature selection module: This module filters the feature data mapped and compressed by the hash algorithm according to the set threshold, i.e., selects features, retains features that significantly contribute to the classification of malicious code families, and generates a compressed feature set.

[0026] FPN-Transformer model module: Use the FPN-Transformer model to perform in-depth analysis and feature extraction on the feature data output by the feature selection module;

[0027] Multi-layer regression feature extraction model module: Use the multi-layer regression feature extraction model to extract multi-scale feature information from the feature data output by the FPN-Transformer model, generate channel attention features and spatial attention features, and fuse them. Use the linear layer to perform linear transformation on the fused features, input the linearly transformed features into the regression layer, and generate the autocorrelation matrix.

[0028] Classification result output module: Based on the autocorrelation matrix obtained by the multi-layer regression feature extraction model, it determines whether there is malicious code in the code file, obtains the malicious code family to which the malicious code belongs, and outputs the final classification result.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] 1) The present invention combines the feature pyramid network (FPN) and the Transformer model to construct an FPN-Transformer model, providing multi-level and multi-perspective feature data for the multi-layer regression feature extraction model. The multi-layer regression feature extraction model is then used to integrate and fuse the features of different levels extracted by the FPN-Transformer model. Compared with the existing malicious code classification method that uses a single classification model, the present invention successively adopts two models, namely, first adopting the FPN-Transformer model to decompose and mine the input data features, and then adopting the multi-layer regression feature extraction model to perform attention weight enhancement, feature extraction, and feature fusion. The fused features are input into the autocorrelation matrix classifier to obtain the classification of the malicious code, effectively improving the accuracy and generalization ability of the malicious code classification method, preventing the classification model from overfitting and avoiding the classification model collapse phenomenon, and improving the stability of the classification model.

[0031] 2) This invention utilizes a hash function to select features from feature data before inputting it into the FPN-Transformer model. The hash function's randomness allows for dynamic feature mapping and compression, making the model more adaptable to different types of malware and reducing the risk of overfitting. Traditional feature selection methods, such as those based on statistical features or information gain, are typically fixed, meaning that once features are selected, the model will continue to rely on them in subsequent training. These existing methods often exhibit shortcomings when dealing with dynamic and complex malware. This invention combines the hash random compression method with a deep learning model, enabling adaptive learning and screening of key features, improving the accuracy and efficiency of malware classification.

[0032] 3) This invention uses the FPN-Transformer model to perform in-depth analysis and feature extraction of malicious code feature data. Compared to traditional deep learning methods, this parallel decomposition mechanism to obtain multi-scale features is more flexible and detailed. The Transformer's self-attention mechanism enables the model to pay more attention to the relationships and contextual information between features when analyzing features. This mechanism is particularly useful in malicious code classification. Compared with deep learning models such as LSTM, the FPN-Transformer module can process features in parallel and utilize the self-attention mechanism to efficiently capture long-distance dependencies without the need to traverse the sequence step by step, making it more efficient and effective in handling complex malicious code classification tasks.

[0033] 4) The present invention uses a multi-layer regression feature extraction model to synthesize and fuse the multi-level and multi-scale features output by the FPN-Transformer model. The multi-layer regression feature extraction model not only performs simple feature extraction, but can also extract multi-scale information from the features output by the FPN-Transformer model, and perform feature fusion through channel attention and spatial attention mechanisms; while traditional deep learning models, such as single-layer fully connected networks or single convolutional layers, can usually only capture information at a certain level or dimension of the input features. The multi-layer regression feature extraction model of the present invention uses multi-level regression analysis to not only extract and fuse multi-scale features, but also deeply explore the complex relationships between features through channel attention and spatial attention mechanisms. This deep feature fusion enables the model to better capture the multi-dimensional features of malicious code, thereby achieving better results in classification tasks.

[0034] 5) The present invention utilizes an autocorrelation matrix classifier to fuse the feature data output by the parallel channel attention module and spatial attention module, thereby optimizing the feature structure diagram, facilitating accurate classification of the malicious code family to which the malicious code belongs, and further enhancing the recognition accuracy of the present invention for features of different malicious code families.

[0035] 6) The model of this invention can adaptively learn feature representations for different data distributions, thereby more accurately identifying and classifying malicious code families. This improves classification accuracy and efficiency, and reduces reliance on high-quality training data, making it more efficient when processing large or low-quality datasets. This method reduces computational resource consumption and improves the feasibility and effectiveness of the model in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The present invention will be further described below with reference to the accompanying drawings and examples.

[0037] Figure 1Schematic diagram of data flow of a malicious code classification method according to an embodiment of the present invention.

[0038] Figure 2 Schematic diagram of the Hash random compression process according to an embodiment of the present invention.

[0039] Figure 3 Schematic diagram of the structure of the FPN-Transformer model of an embodiment of the present invention.

[0040] Figure 4 Schematic diagram of a multi-layer regression feature extraction model according to an embodiment of the present invention.

[0041] Figure 5 This is a comparison chart of the classification effects of the present invention and the Transformer-CNN model. DETAILED DESCRIPTION

[0042] In order to improve the accuracy and efficiency of malicious code family classification, the embodiment of the present invention proposes a malicious code classification method and system based on hash function and FPN-Transformer. The main implementation principles, specific implementation process and corresponding beneficial effects of the embodiment of the present invention are described in detail below with reference to the accompanying drawings.

[0043] like Figure 1 As shown in the figure, the specific steps of the malicious code classification method based on the hash function and FPN-Transformer include:

[0044] Step 1: Extract the original malicious code file from the open source dataset PS and perform data preprocessing.

[0045] Step 1.1: Extract required features from the input data, including abstract syntax tree (AST), node, code, entropy, and other features.

[0046] Step 1.2: Clean the noise and irrelevant information in the data, delete null values ​​or outliers, and ensure data quality.

[0047] Step 1.3: Normalize the data to ensure comparability between different features. The normalization formula is:

[0048]

[0049] In the formula is the mean, is the standard deviation, 、 These are the feature data before and after normalization respectively.

[0050] Step 1.4: Select features that are useful for the classification task and remove redundant features.

[0051] Step 2: Perform hash random compression on the feature data obtained in step 1 to reduce the dimension of the feature data and reduce the noise, such as Figure 2 shown.

[0052] Step 2.1: Use a hash function to map the preprocessed feature values ​​to the hash function space.

[0053] Step 2.1.1: Select a suitable hash function for data preprocessing. The selected hash function has efficient mapping and low conflict characteristics.

[0054] Step 2.1.2: The feature data obtained in step 1 Divide into multiple small pieces , use the hash function selected in step 2.1.1 to calculate each small block Perform random mapping and compression, the hash function is:

[0055]

[0056] In the formula h represents a hash function, i is the eigenvector, i is a random vector, is a prime number, is the size of the hash space; d Indicates the size of the feature dimension.

[0057] Step 2.2: Filter important features based on the preset threshold and reduce the influence of irrelevant features.

[0058] Step 2.2.1: Set the threshold σ based on the eigenvalue distribution and feature importance measurement;

[0059] Step 2.2.2: retain the features below the threshold σ and discard the other features. The calculation formula is:

[0060]

[0061] In the formula Indicates the filtered hash feature data.

[0062] Step 3: Input the filtered features into the FPN-Transformer classification model, such as Figure 3 As shown in Figure 1, the FPN-Transformer model is used to perform in-depth analysis and feature extraction on the compressed feature data.

[0063] Step 3.1: Convert the sample feature data input to the FPN-Transformer classification model into an embedding vector. The dimension of the sample feature data is N×128, where N is the number of samples and the feature dimension is 128.

[0064] Step 3.2: Perform four average pooling operations of different sizes on the embedded vector to generate four sets of feature maps, where the pooling window sizes are 2, 4, 8, and 16, and the feature dimensions after pooling are N×64, N×32, N×16, and N×8, respectively.

[0065] Step 3.3: Concatenate the four groups of pooled feature maps together in the feature dimension to form a large feature patch.

[0066] Step 3.4: The feature patch is fed into an encoder for processing. The number of encoders is adjusted based on the model's performance to find the optimal parameters. In this example, six encoders are used. Each encoder contains a multi-head attention mechanism unit, a feedforward neural network, and a normalization layer.

[0067] Step 3.4.1: The multi-head attention mechanism unit calculates the correlation between input features, generates an attention weight matrix, and uses 8 attention heads to capture global information.

[0068] Step 3.4.2: Use a feedforward neural network to perform nonlinear transformation on the features output by the attention mechanism. The hidden layer dimension of the feedforward neural network used is 512.

[0069] Step 3.4.3: The normalization layer normalizes the output of each layer, and the feature representation dimension after feature generation is N×120.

[0070] Step 3.5: The features output by the encoder are fed into the decoder for processing. The decoder structure is similar to the encoder, including a multi-head attention mechanism, a feedforward neural network, and a normalization layer. In this example, six decoders are used, similar to the encoder. The data processing process for each decoder is the same as that of the encoder in step 3.4. The final feature representation after feature reconstruction has a dimension of N × 120.

[0071] Step 4: The features reconstructed from the encoder features in step 3 are further fused and classified through a multi-layer regression feature extraction model, such as Figure 4 shown.

[0072] Step 4.1: Use the channel attention module to extract multi-scale feature information from the feature data output by the FPN-Transformer model and generate channel attention features.

[0073] Step 4.1.1: In the channel attention module, the input feature representation is converted into an embedding vector suitable for subsequent processing through the input embedding layer.

[0074] Step 4.1.2: Use average pooling (AvgPool) and maximum pooling (MaxPool) operations to generate two sets of feature maps. The feature dimension after pooling is still N×120N.

[0075] Step 4.1.3: Input the pooled features into the shared multi-layer perceptron (MLP) for feature transformation. The shared MLP transforms the feature dimension to N×60N.

[0076] Step 4.1.4: Fuse the transformed features through element-wise addition Sum and element-wise multiplication Multiply operations to generate channel attention features.

[0077] Step 4.2: Use the spatial attention module to extract multi-scale feature information from the feature data output by the FPN-Transformer model and generate spatial attention features.

[0078] Step 4.2.1: In the spatial attention module, the input feature representation is converted into an embedding vector using the input embedding layer.

[0079] Step 4.2.2: Use average pooling (AvgPool) and maximum pooling (MaxPool) to generate two sets of feature maps. The feature dimension after pooling is still N×120N.

[0080] Step 4.2.3: The pooled features are input to the convolution layer Conv for feature convolution. The feature dimension after convolution is still N×120.

[0081] Step 4.2.4: The convolved features are fused through element-wise addition Sum and element-wise multiplication Multiply operations to generate spatial attention features.

[0082] Step 4.3: Fuse the channel attention features and spatial attention features to generate the final attention feature representation.

[0083] Step 4.4: Use the linear layer to perform linear transformation on the fused features, with the output dimension being N×120.

[0084] Step 4.5: Input the linearly transformed features into the regression layer to generate the autocorrelation matrix for the final feature classification. The output dimension of the autocorrelation matrix is ​​N × 𝜆, where 𝜆 is the number of labels for the classification task. The mathematical relationship of the autocorrelation matrix classifier is:

[0085]

[0086] In the formula represents the initialization parameters in the label space, represents the parameters in another dimension in the label space, represents the Kronecker delta function, Label representation used to distinguish different categories, and Represents the similarity or angular relationship between two vectors in the label space in the high-dimensional space.

[0087] Step 5: Output the predicted label category and compare it with the true label category to calculate the loss value.

[0088] In the embodiment, the training of the FPN-Transformer model and the multi-layer regression feature extraction model specifically includes:

[0089] 1) Generate a training sample dataset, which contains samples from actual network traffic or pre-designed malicious code;

[0090] 2) Label the training sample dataset and add a category label to each sample image. The category label indicates which malware family the sample belongs to.

[0091] 3) The number of samples in the dataset should be between 1000 and 5000, and the samples of each family should be balanced to improve the generalization ability and accuracy of the model.

[0092] In this example, we used the malicious code dataset PS, publicly available on Github by White. This dataset contains samples from multiple malware families and is divided into six families: Class 0 = Downloader, Class 1 = Shellcode Inject, Class 2 = Unicorn, Class 3 = Powerfun, Class 4 = SET, and Class 5 = PowerShellEmpire. The example runs on an Intel(R) Xeon(R) Gold 6330 CPU @ 2.00GHz, a GeForce RTX 3090 GPU, and 500GB of memory. Python version 3.7 was used. Tools such as Pytorch and Sklearn were used to implement and test the methods described in this article.

[0093] The number of model iterations in the embodiment is uniformly selected as 100 times, the feature dimension of the input data of the model is 512, the hidden layer dimension is 64, the number of heads of the multi-head attention mechanism in the FPN-Transformer model is 8, the number of layers of the encoder is 1, the number of layers of the decoder is 2, the optimization algorithm is selected as the Adam algorithm, and the learning rate is set to 0.0001.

[0094] The experimental results show that the classification accuracy of the proposed method on the White PS dataset reaches 97.8%. The classification precision, recall rate and F1 value also reach a high level, and the classification accuracy of the malicious code families Downloader, ShellcodeInject,

[0095] The classification accuracy of Unicorn, Powerfun, SET, and PowerShell Empire is shown in Table 1.

[0096] In addition, the present invention is compared with the latest malicious code classification model Transformer-CNN. The comparison results are as follows: Figure 5 As shown in Figure 5 (a), it is a scatter plot of the distribution of data points of different categories in the original data set. Although the boundaries of data points of different categories are relatively clear, there is still a certain degree of confusion. Figure 5 5(b) and 5(d) compare the clustering effects of the Transformer-CNN model and the method of the present invention. The figure shows the effect of reducing the high-dimensional data to a two-dimensional plane. Figure 5 Figures 5 (c) and 5 (e) compare the fit between the predicted values ​​and the true labels of the Transformer-CNN model and the method of the present invention through line graphs. The results show that the predicted line of the method of the present invention is closer to the line of the true label and shows a smaller deviation, which confirms the superiority of the method of the present invention in accuracy and generalization ability.

[0097] Table 1 Classification accuracy of each malicious code family

[0098] .

Claims

1. The malicious code classification method based on Hash function and FPN-Transformer is characterized by: Use hash functions to compress the code file data to be classified, reduce the dimension of feature data and reduce noise; The feature pyramid network (FPN) and the Transformer model are combined to construct the FPN-Transformer model, which provides multi-level and multi-perspective feature data for the multi-layer regression feature extraction model. The multi-layer regression feature extraction model is used to integrate and fuse the features of different levels extracted by the FPN-Transformer model, and the final code classification result is output based on the fusion result. The malicious code classification method comprises the following steps: Step 1: Data preprocessing: Using a natural language processing model to extract preliminary feature data from the code files to be classified, capturing the semantic and structural information of the code; Step 2: Perform hash random compression on the feature data obtained in step 1 to reduce the dimension of the feature data and reduce noise; Step 2.1: Use the hash function to map the preprocessed feature values ​​to the hash function space; Step 2.2: Filter important features based on the preset threshold and reduce the influence of irrelevant features; Step 3: Use the FPN-Transformer model to perform in-depth analysis and feature extraction on the compressed feature data; Step 3.1: Convert the input sample feature data into an embedding vector; Step 3.2: Perform average pooling operations of different sizes on the embedded vectors to generate multiple sets of feature map data; Step 3.3: Concatenate the multiple feature map data obtained in step 3.2 in the feature dimension to form a feature patch; Step 3.4: Input the feature patch obtained in step 3.3 into the encoder for processing; Step 3.4.1: Use the multi-head attention mechanism unit to calculate the correlation between input features and generate the attention weight matrix; Step 3.4.2: Use a feedforward neural network to perform nonlinear transformation on the features output by the multi-head attention mechanism unit; Step 3.4.3: Normalize the feature data output by the feedforward neural network; Step 3.5: The feature data output by the encoder is input into the decoder for processing. The data processing process of the decoder is the same as step 3.4, and multi-level and multi-view feature data is obtained; Step 4: The feature data obtained in step 3 is further fused and classified through a multi-layer regression feature extraction model; Step 5: Based on the output results of the multi-layer regression feature extraction model, determine whether there is malicious code in the code file, and obtain the malicious code family to which the malicious code belongs.

2. The malicious code classification method according to claim 1, characterized in that: The FPN-Transformer model specifically includes multiple average pooling layers, M encoders, and M decoders, where M is the number of encoders. The encoder includes an input embedding layer, a multi-head attention unit, a normalization layer, a feedforward neural network, and a normalization layer connected in sequence. The structure of the decoder is the same as that of the encoder. Multi-head attention units with self-attention mechanism and feed-forward neural networks are used for feature transformation and enhancement.

3. The malicious code classification method according to claim 2, characterized in that: The multi-layer regression feature extraction model specifically includes a parallel channel attention module and a spatial attention module, a linear layer and a regression layer, and an autocorrelation matrix classifier. The channel attention module includes an input embedding layer, a parallel average pooling layer and a maximum pooling layer, and a shared multi-layer perceptron; The spatial attention module includes an input embedding layer, parallel average pooling layer and maximum pooling layer, and a convolutional layer; The channel attention module and spatial attention module are combined with the linear layer and regression layer to capture multi-scale information of malicious code features. The shared multi-layer perceptron of the channel attention module is combined with the regression layer to enhance the richness and robustness of feature expression. The autocorrelation matrix classifier uses the autocorrelation matrix to evaluate and strengthen the relationship between classification features, optimizes the feature combination through autocorrelation, and improves the accuracy and robustness of classification.

4. The malicious code classification method according to claim 3, characterized in that: Step 1 specifically includes the following sub-steps: Step 1.1: Use the CodeBERT model to extract feature data from the code file, including the abstract syntax tree (AST), node, code, and entropy. Step 1.2: Clear the noise and irrelevant information in the feature data, and delete null values ​​or outliers; Step 1.3: Standardize or normalize the feature data to ensure comparability between different features; the formula used for normalization is as follows, where is the mean, is the standard deviation: ； In the formula is the mean, is the standard deviation, 、 These are the feature data before and after normalization processing; Step 1.4: Select feature data that is useful for the classification task and remove redundant feature data.

5. The malicious code classification method according to claim 4, characterized in that: The step 2.1 specifically includes the following sub-steps: Step 2.1.1: Select a suitable hash function for data preprocessing. The selected hash function has the characteristics of efficient mapping and low conflict. Step 2.1.2: The feature data obtained in step 1 Divide into multiple small pieces , use the hash function selected in step 2.1.1 to calculate each small block Perform random mapping and compression, the hash function is: ； In the formula h represents a hash function, i is the eigenvector, i is a random vector, is a prime number, is the size of the hash space; d Indicates the size of the feature dimension.

6. The malicious code classification method according to claim 5, characterized in that: The step 2.2 specifically includes the following sub-steps: Step 2.2.1: Set the threshold σ based on the eigenvalue distribution and feature importance measurement; Step 2.2.2: retain the features below the threshold σ and discard the other features. The calculation formula is: ； In the formula Indicates the filtered hash feature data.

7. The malicious code classification method according to claim 6, characterized in that: The step 4 specifically includes: 1) Use the channel attention module to extract multi-scale feature information from the feature data output by the FPN-Transformer model and generate channel attention features; 1.1) The input feature representation is converted into an embedding vector through the input embedding layer; 1.2) Use average pooling AvgPool and maximum pooling MaxPool operations to generate two sets of feature maps; 1.3) Input the pooled features into the shared multi-layer perceptron for feature transformation; 1.4) The features transformed by the shared multilayer perceptron are fused through element-wise addition and element-wise multiplication operations to generate channel attention features; 2) Use the spatial attention module to extract multi-scale feature information from the feature data output by the FPN-Transformer model and generate spatial attention features; 2.1) Use the input embedding layer to convert the input feature representation into an embedding vector; 2.2) Use average pooling AvgPool and maximum pooling MaxPool operations to generate two sets of feature maps; 2.3) Input the pooled features into the convolution layer Conv for feature convolution operation; 2.4) The convolutional features are fused through element-wise addition and element-wise multiplication operations to generate spatial attention features; 3) Fuse the channel attention features and spatial attention features to generate the final attention feature representation; use the linear layer to linearly transform the fused features; input the linearly transformed features into the regression layer to generate the autocorrelation matrix.

8. The malicious code classification method according to claim 7, characterized in that: The mathematical relationship of the autocorrelation matrix classifier is: ； In the formula represents the initialization parameters in the label space, represents the parameters in another dimension in the label space, represents the Kronecker delta function, Label representation used to distinguish different categories, and Represents the similarity or angular relationship between two vectors in the label space in the high-dimensional space.

Images